prisma-next: make the adapter EQL v3-only — stop installing the EQL v2 baseline (F3, Supabase superuser block)

[coderdan]

Summary

@cipherstash/prisma-next should be EQL v3 only. Today the adapter still
ships and applies the EQL v2 baseline migration, which is the direct cause
of the rc.3 skilltester F3 blocker ("Prisma Next adapter is unusable on
Supabase — installs EQL v2, needs a superuser").

We want EQL v2 gone from this package entirely — no v2 install, no v2 authoring
surface.

Root cause — the migration DAG forces v2

The control-plane descriptor (src/exports/control.ts) registers both
baseline migrations, and the v3 baseline is chained on top of the v2 baseline:

baseline dir	from → to	provides invariant
20260601T0000_install_eql_bundle (v2)	null → 1e86a0	cipherstash:install-eql-bundle-v1
20260601T0100_install_eql_v3_bundle (v3)	1e86a0 → 1e86a0 (self-edge)	cipherstash:install-eql-v3-bundle-v1

migrations/refs/head.json requires both invariants. On a fresh database
there is exactly one path to head: apply the v2 install first (the only edge out
of null), then the v3 self-edge. A pure-v3 app cannot reach head without**
**installing the EQL v2 bundle first, and that v2 install fails on Supabase's
non-superuser postgres role (see #599).

This is why "EQL v3 installs fine as non-superuser" (the CLI stash eql install
path, #691/#692) and "prisma-next installs v2" are both true — they are
different install paths. Only the adapter drags in v2.

Why #694 did not fix this

#694 changed how the v3 baseline sources its SQL (runtime injection from
@cipherstash/eql vs. a baked ~1.7 MB blob). It left the DAG untouched — its
commit message notes the v3 baseline "is an invariant-only self-edge
(from === to)". It never removed v2 from the apply path, and was not meant to.

Fix

Make the adapter v3-only.

Phase 1 — stop installing EQL v2 (the F3 unblock):

• Drop the v2 baseline from the descriptor's migrations array
  (src/exports/control.ts) and remove the v2 codec hooks it registers.
• Re-root the v3 baseline: 20260601T0100_install_eql_v3_bundle/migration.json
from: <v2-to-hash> → from: null; recompute the migration hash.
• migrations/refs/head.json: require only
  cipherstash:install-eql-v3-bundle-v1.
• Delete migrations/20260601T0000_install_eql_bundle/.

After Phase 1, prisma-next migration apply installs only EQL v3 and works
on Supabase as a non-superuser.

Phase 2 — remove the dormant v2 authoring/runtime surface so nobody can
reach for a v2 path that no longer installs:

• cipherstashFromStackV2 (src/stack/from-stack.ts) and the v2 ./stack
  wiring.
• The *V2 column constructors in src/exports/column-types.ts.
• The v2 runtime plane (src/execution/*), v2 codecs
  (src/migration/cipherstash-codec.ts, codec-hooks-factory.ts,
  call-classes.ts, eql-bundle.ts, eql-install.generated.ts), v2 codec ids
  in src/extension-metadata/constants.ts.
• Regenerate contract.json / contract.d.ts so no v2 codec ids remain.
• Prune v2 tests / fixtures.

Acceptance

• prisma-next migration apply on a fresh Supabase DB (non-superuser
  postgres) succeeds and installs only EQL v3.
• No eql_v2 schema/objects are created by this package.
• stash-prisma-next skill reflects the v3-only reality (see fix(skills): correct stale EQL v3 rollout guidance in bundled skills #706).
• Changeset added (breaking, pre-GA).

References

• rc.3 skilltester finding F3.
• stash eql migration: migration-first, ORM-agnostic EQL v3 install (fixes prisma-next superuser-on-Supabase) #690 — migration-first, ORM-agnostic EQL v3 install (umbrella; "fixes
  prisma-next superuser-on-Supabase"). feat(prisma-next): source EQL v3 install SQL from @cipherstash/eql at runtime #694 was one slice (SQL sourcing), not
  the DAG fix.
• EQL v2 Supabase / no-operator-family install fails on non-superuser roles (out-of-order DDL) #599 — EQL v2 install fails on non-superuser roles on Supabase.
• fix(skills): correct stale EQL v3 rollout guidance in bundled skills #706 — stale v3 rollout guidance in bundled skills.