feat(sync): upstream the jobs scheduler and metaschema store modules from constructive-db

[pyramation]

Summary

Downstream sync of the three pgpm modules whose deploy/ trees had diverged from their source of truth in constructive-io/constructive-db (pgpm-modules/*). Nothing here is hand-written: trees were copied from upstream and repackaged with pgpm package; only the metaschema-modules test expectations (repo-owned) were edited to match.

jobs / database-jobs — app_jobs.run_scheduled_job is now concurrency-safe. Two concurrent runners ticking the same schedule could both enqueue. Upstream serializes on the schedule row and treats an in-flight job carrying the same key as already covering the tick:

SELECT … FROM app_jobs.scheduled_jobs s WHERE s.id = … FOR UPDATE INTO sched;
IF NOT FOUND THEN RETURN j; END IF;   -- schedule deleted: null record unschedules it
…
INSERT INTO app_jobs.jobs … ON CONFLICT (key) DO UPDATE SET …

(previously a plain … INTO last_id lookup with no lock and no key conflict handling)

metaschema-modules — the store-module quadrants settle. config_secrets_user_module is dropped and replaced by internal_config_module (the namespace-free, Postgres-resident plaintext quadrant, never projected into Kubernetes), and cluster_module is added. The infra_config_module / infra_secrets_module / internal_secrets_module tables change only in their reference comments.

Test churn in packages/metaschema-modules/__tests__/modules.test.ts: the expected-module list swaps config_secrets_user_module for internal_config_module + cluster_module, and the FK-relationship snapshot is regenerated.

Package suites pass locally: jobs 4/4, database-jobs 7/7, metaschema-modules 8/8.

Link to Devin session: https://app.devin.ai/sessions/f824ef1a6c9c40ada3d1c15cd1b6334d
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring