fix(migration): TAM-7176: forget the source server's identity before an upgrade test

[dannash100]

The upgrade intent's default pre-migrate SQL hides a restore's encrypted secrets so the migrate job can run under the default key, but leaves the plaintext sync host and email pointing at the source's central.

• Calls Tamanu's forget_server_identity() first when the snapshot has it (db: TAM-7176: add forget_server_identity() for copied databases tamanu#11378), then hides the remaining encrypted values as before.
• Older snapshots get today's behaviour unchanged, which the existing migration integration test covers.
• Replaces fix(restore): scrub tamanu sync and device identity on every restore #164: verify and analytics replicas never run Tamanu or hold the key, so a scrub on every restore guarded nothing. Also fixes a typo that fails Spellcheck on main.

🦸 Review Hero

• Run Review Hero

[review-hero]

🦸 Review Hero Summary (round 1) · reviewed dfe3b40 · on z-ai/glm-5.3-flash:nitro
3 agents reviewed this PR | 0 critical | 0 suggestions | 0 nitpicks | Filtering: consensus 3 voters, 1 below threshold

No issues found. Looks good!

Below consensus threshold (1 unique issue not confirmed by majority)

Location	Agent	Severity	Comment
src/controllers/canopy/intent.rs:161	Bugs & Correctness	suggestion	When public.forget_server_identity() merely exists, the DO block commits to it and RETURNs, skipping the soft-delete fallback entirely. If a snapshot ships a version of that function that errors ...

[review-hero]

🦸 Review Hero Summary (round 2) · reviewed dfe3b40 · on claude-sonnet-5
3 agents reviewed this PR | 0 critical | 0 suggestions | 0 nitpicks | Filtering: consensus 3 voters, 1 below threshold

No issues found. Looks good!

Below consensus threshold (1 unique issue not confirmed by majority)

Location	Agent	Severity	Comment
src/controllers/canopy/intent.rs:161	Bugs & Correctness	suggestion	to_regprocedure matches any pg_proc entry regardless of prokind, so if Tamanu's forget_server_identity() is declared as a PROCEDURE (plausible for a void, side-effect-only routine, especially i...

[review-hero]

🦸 Review Hero Summary (round 3) · reviewed 6d413f0 · on z-ai/glm-5.3-flash:nitro
8 agents reviewed this PR | 1 failed | 0 critical | 1 suggestion | 0 nitpicks | Filtering: consensus 3 voters, 2 below threshold, 1 suppressed

Below consensus threshold (2 unique issues not confirmed by majority)

Location	Agent	Severity	Comment
src/controllers/canopy/intent.rs:161	Design & Architecture	suggestion	The to_regprocedure guard silently degrades to the pre-PR behaviour when the function isn't found: zero-arg lookup under the public schema only, so a Tamanu version that moves the function, gives i...
src/controllers/canopy/intent.rs:897	Design & Architecture	nitpick	The !contains("RETURN;") assertion is unexplained and guards a non-obvious regression (an early RETURN after the identity block would skip the secret-hiding loop). The other two assertions carry me...

Local fix prompt (copy to your coding agent)

Fix these issues identified on the pull request. One commit per issue fixed.

-------

`src/controllers/canopy/intent.rs:161`: The new guard only checks existence, not executability: `to_regprocedure('public.forget_server_identity()')` resolves the function regardless of the connecting role's EXECUTE privilege, so if the snapshot has the function but the restore's role can't call it (or the function itself errors), the `PERFORM` raises inside the DO block and aborts the whole statement — meaning the `S1:` soft-delete in the same block never runs either. That regresses the exact failure this SQL was written to work around: `run_pre_migrate_sql` (src/controllers/restore/migration.rs:390) returns the error, the migration test never starts, and the reconcile retries into the same wall forever. Guard on privilege instead — `IF to_regprocedure('public.forget_server_identity()') IS NOT NULL AND has_function_privilege(to_regprocedure('public.forget_server_identity()'), 'EXECUTE') THEN` — or wrap the `PERFORM` in a nested `BEGIN ... EXCEPTION WHEN OTHERS THEN NULL; END;` so a failure to forget the identity never takes the secret-hiding down with it.