fix(perf): bound truth-chain quality reads

.gitea/workflows/run-migration.yml

@@ -6,7 +6,8 @@
 #   1. 用 MIGRATION_DATABASE_URL (awoooi_migrator 限權帳號) 連 PG
 #   2. 只跑「新增」的 migration (比對已執行列表)
 #   3. 跑後寫 asset_discovery_run + automation_operation_log 記錄
-#   4. 失敗自動 rollback (single transaction + ON_ERROR_STOP)
+#   4. 一般 migration 使用 single transaction；CONCURRENTLY migration
+#      必須保持 transactionless，並由配對 rollback 與 post-verifier 收斂
 #
 # 觸發: 受控手動觸發；apps/api/migrations/ 有變更時先做 source diff / dry-run / rollback verifier
 
@@ -93,13 +94,21 @@ jobs:
           apply_migration() {
             local url="$1"
             local file="$2"
-            psql "$url" \
-              -v ON_ERROR_STOP=1 \
-              --single-transaction \
-              -f "$file"
+            if grep -Eiq '^[[:space:]]*(CREATE([[:space:]]+UNIQUE)?|DROP)[[:space:]]+INDEX[[:space:]]+CONCURRENTLY' "$file"; then
+              if grep -Eiq '^[[:space:]]*(BEGIN|START[[:space:]]+TRANSACTION|COMMIT)([[:space:]]|;|$)' "$file"; then
+                echo "::error::CONCURRENTLY migration must not contain an explicit transaction: $file"
+                return 1
+              fi
+              echo "migration_mode=transactionless_concurrently file=$file"
+              psql "$url" -v ON_ERROR_STOP=1 -f "$file"
+              return
+            fi
+
+            echo "migration_mode=single_transaction file=$file"
+            psql "$url" -v ON_ERROR_STOP=1 --single-transaction -f "$file"
           }
 
-          # 套用每個新檔 (single transaction per file)
+          # 套用每個新檔；模式由 apply_migration 依 SQL 契約判定。
           echo "${{ steps.diff.outputs.new_files }}" | while IFS= read -r file; do
             [ -z "$file" ] && continue
             echo "=== Applying: $file ==="