Apply Basic signup migration safely

.github/workflows/migrate-basic-signup.yml

@@ -0,0 +1,60 @@
+name: Apply Caterium Basic Signup Migration
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - ".github/workflows/migrate-basic-signup.yml"
+      - "ops/sql/SUPABASE-V17.9.1-PUBLIC-BASIC-SIGNUP.sql"
+      - "supabase/migrations/20260922102500_public_basic_signup.sql"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: caterium-basic-signup-migration
+  cancel-in-progress: false
+
+jobs:
+  migrate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 8
+    env:
+      PGHOST: db.usfjwhztqoopzzfmfbis.supabase.co
+      PGPORT: "5432"
+      PGDATABASE: postgres
+      PGUSER: postgres
+      PGPASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
+      PGSSLMODE: require
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Require configured database password
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${PGPASSWORD:-}" ]; then
+            echo "::error::Repository secret SUPABASE_DB_PASSWORD is not configured."
+            exit 2
+          fi
+
+      - name: Apply only v17.9.1 public Basic signup migration
+        shell: bash
+        run: |
+          set -euo pipefail
+          psql -v ON_ERROR_STOP=1 -f ops/sql/SUPABASE-V17.9.1-PUBLIC-BASIC-SIGNUP.sql
+
+      - name: Verify server policy and workspace function
+        shell: bash
+        run: |
+          set -euo pipefail
+          psql -v ON_ERROR_STOP=1 -At <<'SQL'
+          select public.caterium_public_signup_policy();
+          select case
+            when pg_get_functiondef('public.sun_create_workspace(text)'::regprocedure) like '%public_signup_basic%'
+             and pg_get_functiondef('public.sun_create_workspace(text)'::regprocedure) like '%v_promo.plan_id%'
+            then 'PASS'
+            else 'FAIL'
+          end;
+          SQL