feat: journal project root changes during expansion

[Joncallim]

Scope

Adds the expand-window-only project-root change journal. A protected PostgreSQL trigger records bounded insert, root-update, and archive identities. Its singleton counter is transactionally updated before the append, so a rollback cannot leave a generation gap.

Safety boundaries

The journal stores no local path, root reference, free text, JSON, or arbitrary reason. It is append-only and protected by S4 ownership and direct-ACL checks. The in-migration root-ref unique index is removed; it must be created concurrently by the later operator cutover.

Deliberately not included

C6 and C7 are required before this can integrate into PR #198: watermark capture, reconciliation, concurrent unique-index creation, strict cutover, and their PostgreSQL proof suite are not part of this child.

Validation

• Focused journal/static tests: 22 passed
• Focused journal plus S4 context tests: 47 passed
• Full unit suite: 1,609 passed, 19 skipped
• TypeScript, lint, production build, and git diff --check passed

The role-provisioned PostgreSQL migration proof remains CI-only in this local environment.