docs(cli,migrate): reference #585 for v3 flag gaps, scope migrate README to v2

Addresses review feedback on #583:
- Note that gating --drizzle and --latest behind --eql-version 2 is tracked
  in #585, at both sites where v3 declines the v2-only path.
- State plainly that @cipherstash/migrate targets EQL v2, that v3 is opt-in
  and direct-install-only, and that v3 columns are outside this lifecycle.

Author: tobyhede

packages/cli/src/commands/db/install.ts

@@ -122,6 +122,7 @@ export async function installCommand(options: InstallOptions) {
   // v3 supports the direct install path only. Explicit --drizzle/--migration
   // are rejected up-front by validateInstallFlags; auto-DETECTED drizzle or
   // migration modes fall back to direct here rather than erroring.
+  // Gating the v2-only paths behind --eql-version 2 is tracked in #585.
   if (eqlVersion === 3 && resolved.drizzle) {
     p.log.info(
       'EQL v3 does not support the Drizzle migration path yet — installing directly.',

packages/cli/src/installer/index.ts

@@ -287,6 +287,7 @@ export class EQLInstaller {
     if (latest && eqlVersion === 3) {
       // No public v3 release artifacts exist yet — the v3 bundles are vendored
       // from the generated monolith (see scripts/build-eql-v3-sql.mjs).
+      // Gating --latest behind --eql-version 2 is tracked in #585.
       throw new Error(
         '`--latest` is not supported for EQL v3 yet: no public v3 release artifacts exist. Use the bundled install.',
       )

packages/migrate/README.md

@@ -14,6 +14,8 @@ schema-added → dual-writing → backfilling → backfilled → cut-over → dr
 
 State is tracked in an append-only `cipherstash.cs_migrations` table installed by `stash eql install`. The EQL intent (which indexes, which cast_as) continues to live in `eql_v2_configuration` so Proxy continues to work against the same database.
 
+> **This package targets EQL v2.** The lifecycle above wraps `eql_v2.*` functions and reads and writes `eql_v2_configuration`. `stash eql install` installs v2 by default; EQL v3 is opt-in via `stash eql install --eql-version 3`, installs via the direct path only, and encodes its configuration in each column's domain type rather than in a configuration table. Columns installed under v3 are not covered by this package's migration lifecycle.
+
 ## API
 
 ```ts