[db_metadata] Parse schema on migration, await backfill (#9878)

Non-atomic schema changes ARE real and CAN hurt you

- Adds CRDB-specific preprocessing and `sqlparser` parsing to each
schema change within Nexus
- Verifies that each change contains "at most one" schema-modifying DDL
statement
- Adds a secondary transaction to each "apply schema change" step, which
verifies that the underlying backfill operation has completed. The
objective here is to transform "delayed, async DDL statements" into
synchronous operations, so we can know "it succeeded fully" or "it
failed" before moving on

Part of #9866
Fixes #9888

Author: smklein

.claude/skills/crdb-change/SKILL.md

@@ -77,7 +77,11 @@ In `nexus/db-model/src/schema_versions.rs`, bump `SCHEMA_VERSION`.
 
 In `nexus/db-model/src/schema_versions.rs`, add the new version to the `KNOWN_VERSIONS` list.
 
-### Step 8: Test the migration
+### Step 8: Generate verification files
+
+Run `EXPECTORATE=overwrite cargo nextest run -p nexus-db-model 'test_migration_verification_files'` to auto-generate `.verify.sql` files for any migration steps that contain backfill-prone DDL (`CREATE INDEX`, `ADD CONSTRAINT`, `ALTER COLUMN SET NOT NULL`, or `ADD COLUMN` with `NOT NULL` / non-null `DEFAULT` / `STORED` computed columns). Check in any generated files alongside the migration. If your migration doesn't contain backfill-prone DDL, no files are generated and this step is a no-op.
+
+### Step 9: Test the migration
 
 Run `cargo nextest run -p omicron-nexus schema` to verify that the migration is correct.
 

Cargo.lock

@@ -64,6 +64,7 @@ tufaceous-artifact.workspace = true
 [dev-dependencies]
 camino-tempfile.workspace = true
 expectorate.workspace = true
-regex.workspace = true
 proptest.workspace = true
+regex.workspace = true
+sqlparser.workspace = true
 test-strategy.workspace = true