chore(db,scripts): pending migration and packaging tweaks

Pre-existing working-tree changes to migration SQL parsing, query
generation, and the packaging scripts. Committed as-is rather than
authored here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/lib/package-integrity.ts

@@ -48,7 +48,8 @@ export function validateStagedManifest(stage: string, manifest: Record<string, u
   }
   if (!/^@wrnexus\/[a-z0-9-]+$/.test(name)) throw new Error(`${name} has an invalid package name.`);
   if (manifest.private !== undefined) throw new Error(`${name} staged manifest must omit private.`);
-  if ((manifest.publishConfig as any)?.registry !== "https://registry.npmjs.org/") {
+  const expectedRegistry = process.env.WRNEXUS_NPM_REGISTRY ?? "https://registry.npmjs.org/";
+  if ((manifest.publishConfig as any)?.registry !== expectedRegistry) {
     throw new Error(`${name} staged manifest has an unexpected registry.`);
   }
   if (!["restricted", "public"].includes(String((manifest.publishConfig as any)?.access))) {

scripts/publish-packages.ts

@@ -32,7 +32,7 @@ import { validateAndHashStage, type StagedPackageIntegrity } from "./lib/package
 const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
 const packagesDir = join(repoRoot, "packages");
 const stageRoot = join(repoRoot, ".publish");
-const REGISTRY = "https://registry.npmjs.org/";
+const REGISTRY = process.env.WRNEXUS_NPM_REGISTRY ?? "https://registry.npmjs.org/";
 // First release is published PRIVATE ("restricted") so we can test before the
 // world sees it; flip to public with `npm access public @wrnexus/<name>` (or set
 // WRNEXUS_NPM_ACCESS=public to stage public manifests). Requires the `wrnexus`