Own migrate objects as audit_core_migrate; pin snapshot-read image

SET ROLE during migrate so tables are not owned by a disposable lease.
Current image sha256:aec5575. T02/T03 recorded done after live rotation
and rollout undo. T05 remote run is partial (port-forward dropped).

deploy/audit-core.yaml

@@ -80,7 +80,7 @@ spec:
         - name: audit-core
           # REPLACE at release time with the built digest. A mutable tag is not
           # an immutable image, and `:latest` must never be the only reference.
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:41493cd5bbd86a3309af07b1a97d41343b91d758a300ad39d71e4a18c17de7cc
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:aec5575ceadf1dc53d0892c0786f1fcd5cb38077ce36ba271ee7204aacd80df5
           imagePullPolicy: IfNotPresent
           ports:
             - name: http

deploy/migrate-job.yaml

@@ -33,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:41493cd5bbd86a3309af07b1a97d41343b91d758a300ad39d71e4a18c17de7cc
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:aec5575ceadf1dc53d0892c0786f1fcd5cb38077ce36ba271ee7204aacd80df5
           imagePullPolicy: IfNotPresent
           command: ["python", "-m", "audit_core", "migrate"]
           env:
@@ -41,6 +41,8 @@ spec:
               value: /etc/audit-core/db
             - name: AUDIT_CORE_DATABASE_SCHEMA
               value: audit_core
+            - name: AUDIT_CORE_MIGRATE_ROLE
+              value: audit_core_migrate
           resources:
             requests:
               cpu: 25m