fix: migrate as durable database owner

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

migrations/env.py

@@ -5,7 +5,7 @@ from logging.config import fileConfig
 from alembic import context
 from sqlalchemy import engine_from_config, pool
 
-from sbom_nexus.config import database_target
+from sbom_nexus.config import database_target, migration_role
 from sbom_nexus.database import database_url, metadata
 
 config = context.config
@@ -41,6 +41,11 @@ def run_migrations_online() -> None:
         poolclass=pool.NullPool,
     )
     with connectable.connect() as connection:
+        role = migration_role()
+        if role and connection.dialect.name != "postgresql":
+            raise RuntimeError("SBOM_NEXUS_MIGRATION_ROLE requires PostgreSQL")
+        if role:
+            connection.exec_driver_sql(f'SET ROLE "{role}"')
         context.configure(
             connection=connection,
             target_metadata=target_metadata,