feat(services): sync domain verification loop from constructive-db

[pyramation]

Summary

Upstreams the services-module SQL that landed in constructive-db#2283 (the domain verify → DNS → issue loop) into packages/services, following the established "sync pgpm modules from constructive-db" pattern. The upstream services package was missing both the new tables and their managed_domains foundation (from constructive-db#2256, which was never upstreamed), so managed_domains is included as a required prerequisite.

Adds 4 objects (each with matching deploy/revert/verify triples + pgpm.plan entries) and regenerates the packaged sql/services--0.1.0.sql:

• services_public.managed_domains — cert-bearing host/wildcard registry, tracking verification_status / tls_status / cert_status independently (database-scoped, hostname domain, db_fkey → metaschema_public.database).
• services_public.domain_verifications — entity-owned (owner_id) ownership-challenge table; holds the public challenge token (DNS TXT value / HTTP-01 token — not a secret), FK → managed_domains ON DELETE CASCADE.
• services_public.domain_events — append-only lifecycle audit trail mirroring resource_events/cluster_events.
• services_private.domain_issue_challenge(uuid, text, uuid) — the domain:issue_challenge function: mints a challenge, supersedes prior outstanding challenges for the same (domain, method), resets verification_status = pending, and emits a challenge_issued event.

pgpm.plan (appended, in dependency order):
  managed_domains/table            [services_public/schema, metaschema-schema:database/table]
  domain_verifications/table       [services_public/schema, managed_domains/table]
  domain_events/table              [services_public/schema, managed_domains/table, domain_verifications/table]
  procedures/domain_issue_challenge[services_private/schema, managed_domains, domain_verifications, domain_events, metaschema-schema:database]

Scope notes

• RLS / permission (manage_domains) / owner_id → users FK wiring is intentionally NOT here. In constructive-db those live in the introspection / metaschema-generators / metaschema packages (apply_metaschema_rls, provision_base_modules, initialize_permissions), which have no counterpart in this repo. This sync is limited to the raw services module DDL + function, matching how the other services tables live upstream.
• No version churn: kept the module at 0.1.0 / packaged filename services--0.1.0.sql (the repo convention where packaged-sql version is decoupled from the lerna package.json version). services.control / package.json / Makefile are untouched. The only edit to an existing file besides pgpm.plan is the regenerated packaged sql, which is purely additive.

Validation

• packages/services deploys cleanly with the 4 new objects on constructiveio/postgres-plus:18 (the CI image).
• pnpm test (services): 2 passed, 12 snapshots passed — existing snapshots unchanged by the additions.

Link to Devin session: https://app.devin.ai/sessions/87c0076b31854a7aac2c551a4e6d2cd0
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring