feat: add migration export and write fencing

tests/test_migration.py

@@ -3,7 +3,7 @@ import json
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import async_sessionmaker
 
-from core_hub.migration import import_bundle, validate_bundle
+from core_hub.migration import export_bundle, import_bundle, validate_bundle
 from core_hub.models import Hub, MigrationRun, Widget
 
 
@@ -114,3 +114,24 @@ async def test_import_bundle_persists_records_and_run_summary(sqlite_engine):
         second = await import_bundle(session, minimal_bundle())
         assert second["counts"]["hubs"]["updated"] == 1
         assert second["counts"]["interactionEvents"]["updated"] == 1
+
+
+async def test_export_bundle_covers_all_source_tables_without_raw_keys(sqlite_engine):
+    sessionmaker = async_sessionmaker(sqlite_engine, expire_on_commit=False)
+    async with sessionmaker() as session:
+        await import_bundle(session, minimal_bundle())
+        bundle = await export_bundle(session, source_revision="source-revision")
+
+    assert set(bundle["records"]) == {
+        "hubs",
+        "hubCapabilityManifests",
+        "apiConsumers",
+        "apiKeys",
+        "widgets",
+        "interactionEvents",
+        "migrationRuns",
+    }
+    assert bundle["sourceRevision"] == "source-revision"
+    assert bundle["bundleSha256"]
+    assert bundle["records"]["apiKeys"][0]["keyHash"] == "a" * 64
+    assert "fullKey" not in json.dumps(bundle)