refactor: fold osv-sync migrations into V1779710880 initial schema

Per Joana's preference (and consistent with how PRs #4148 and #4150
absorbed previous schema deltas), edit the consolidated initial
migration in place rather than layering separate ones while
packages-db is still pre-production.

Folded into V1779710880:

- packages.has_critical_vulnerability — boolean NOT NULL DEFAULT
  FALSE + partial index on TRUE. Replaces the deferred "column
  commented out" stub. Inline comment cites the option-b + MAL-
  semantics decision in ADR-0001 §`has_critical_vulnerability`
  semantics.
- advisories.cvss_source — text, nullable, four documented values
  ('osv_cvss_v3', 'osv_cvss_v4', 'osv_qualitative_fallback',
  'osv_malicious_package'). Inline comment cites ADR-0001 §CVSS
  scoring strategy and lists the values for downstream consumers.
- advisory_affected_ranges unique index — widened from
  (advisory_package_id, COALESCE(introduced_version, '')) to the
  full tuple including COALESCE(fixed_version, '') and
  COALESCE(last_affected, ''). Inline comment cites ADR-0001
  §`advisory_affected_ranges` uniqueness scope.

Deleted (now folded):
- V1779871303__add_cvss_source_to_advisories.sql
- V1779871327__add_has_critical_vulnerability_to_packages.sql
- V1779897650__widen_advisory_affected_ranges_unique_index.sql
- V1779951727__align_advisory_ecosystem_lowercase.sql

The lowercase ecosystem migration goes away entirely: the table is
empty in prod, parseOsvRecord lowercases at the OSV boundary, and
the application is the source of truth for the casing convention.
No backfill needed.

Local cost: one `flyway repair` (or volume drop + reapply) for any
teammate with the branch checked out, since the V1779710880
checksum changes. Same pattern the team used twice this week.

Verified locally: dropped the packages-db volume, ran Flyway from
scratch, all expected columns and indexes present. The 70 unit
tests still pass.

Signed-off-by: Joan Reyero <joan@reyero.io>

Author: joanreyero

backend/src/osspckgs/migrations/V1779710880__initial_schema.sql

@@ -58,10 +58,12 @@ CREATE TABLE packages (
     latest_release_at timestamptz,
     dependent_packages_count int,
     dependent_repos_count int,
-    -- has_critical_vulnerability bool NOT NULL DEFAULT FALSE,
-    -- Deferred: semantics undecided between (a) any advisory with no fixed_version vs
-    -- (b) latest_version falls inside an affected semver range. Lateral join against
-    -- advisory_packages used in queries until this is resolved.
+    -- has_critical_vulnerability: TRUE iff latest_version is inside an active
+    -- affected range of a critical advisory (CVSS >= 7.0) OR a MAL-* malicious-
+    -- package advisory matches the package. Maintained by the deriveCriticalFlag
+    -- activity in packages_worker/src/osv/. See ADR-0001 §`has_critical_vulnerability`
+    -- semantics for the option-b + MAL- override rationale.
+    has_critical_vulnerability bool NOT NULL DEFAULT FALSE,
     criticality_score numeric(10, 4),
     -- is_critical and last_rank_pass_at are not in the original pckgs.md spec; added so
     -- the packages table can answer "is this package critical?" without joining packages_universe,
@@ -82,8 +84,12 @@ CREATE INDEX ON packages (ecosystem, name);
 
 CREATE INDEX ON packages USING gin (keywords);
 
--- INDEX on has_critical_vulnerability removed — column is commented out above.
--- Uncomment both when semantics are decided.
+-- Partial index on has_critical_vulnerability TRUE rows only — that's the bucket
+-- the security overlay query needs ("list all packages with a known critical
+-- vuln"). The FALSE rows dominate the table and don't need an index.
+CREATE INDEX ON packages (has_critical_vulnerability)
+WHERE
+    has_critical_vulnerability;
 
 CREATE INDEX ON packages (criticality_score DESC)
 WHERE
@@ -569,6 +575,15 @@ CREATE TABLE advisories (
     aliases text[], -- CVE-XXXX, GHSA-...
     severity text, -- 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL'
     cvss numeric(3, 1),
+    -- Provenance of the cvss value above. Lets downstream consumers distinguish
+    -- a real vendor-supplied vector from a synthesized qualitative fallback.
+    -- See ADR-0001 §CVSS scoring strategy. Allowed values:
+    --   'osv_cvss_v3'              numeric score from a CVSS_V3 vector
+    --   'osv_cvss_v4'              reserved; v4 numeric scoring deferred
+    --   'osv_qualitative_fallback' synthesized from database_specific.severity
+    --   'osv_malicious_package'    MAL-* id with no CVSS vector
+    -- Extensible to 'ghsa' | 'nvd' as additional sources come online.
+    cvss_source text,
     -- >= 7.0 intentional: treat HIGH + CRITICAL both as actionable
     is_critical bool GENERATED ALWAYS AS (cvss >= 7.0) STORED,
     summary text,
@@ -613,7 +628,18 @@ CREATE TABLE advisory_affected_ranges (
     unaffected_raw text      -- raw UnaffectedVersions string from deps.dev BQ
 );
 
-CREATE UNIQUE INDEX ON advisory_affected_ranges (advisory_package_id, COALESCE(introduced_version, ''));
+-- Full-tuple uniqueness so two ranges sharing introduced_version but differing
+-- in fixed_version or last_affected (cross-distro patches, partial fixes in a
+-- single advisory) both survive insertion. The narrower (advisory_package_id,
+-- introduced_version) form silently collapsed those cases to one row, dropping
+-- the wider range and under-reporting vulnerable windows in the derive step.
+-- See ADR-0001 §`advisory_affected_ranges` uniqueness scope.
+CREATE UNIQUE INDEX ON advisory_affected_ranges (
+    advisory_package_id,
+    COALESCE(introduced_version, ''),
+    COALESCE(fixed_version, ''),
+    COALESCE(last_affected, '')
+);
 
 CREATE INDEX ON advisory_affected_ranges (advisory_package_id);