fix: pin migration schema after role switch

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

hub_core/migrations/roles.py

@@ -10,3 +10,12 @@ def migration_role_statement(role: str | None) -> str | None:
     if not re.fullmatch(r"[a-z_][a-z0-9_]{0,62}", role):
         raise ValueError("HUB_CORE_MIGRATION_ROLE is not a safe PostgreSQL role name")
     return f'SET ROLE "{role}"'
+
+
+def migration_schema_statement(schema: str | None) -> str | None:
+    """Return an explicit, safely quoted migration search path."""
+    if not schema:
+        return None
+    if not re.fullmatch(r"[a-z_][a-z0-9_]{0,62}", schema):
+        raise ValueError("HUB_CORE_MIGRATION_SCHEMA is not a safe PostgreSQL schema name")
+    return f'SET search_path TO "{schema}", public'