fix: keep migration objects on stable role

deploy/README.md

@@ -57,7 +57,9 @@ This is an operator cutover, not an application startup step:
 1. Scale the live SQLite Deployment to zero and verify no pod holds the PVC.
 2. Snapshot or copy the SQLite file without modifying it.
 3. Apply `deploy/tenant-engine-migration.yaml` with the new immutable image and
-   wait for success.
+   wait for success. The Job sets role to the stable
+   `tenant_engine_migrate` group before DDL; short-lived OpenBao login roles
+   must never own schema objects that outlive their lease.
 4. Run the transfer under the migration-role URL:
 
    ```bash

deploy/tenant-engine-migration.yaml

@@ -28,6 +28,8 @@ spec:
         - tenant-engine-migrate
         - --url-file
         - /var/run/secrets/postgres-migration/url
+        - --role
+        - tenant_engine_migrate
         env:
         - name: TENANT_ENGINE_MIGRATION_DATABASE_URL_FILE
           value: /var/run/secrets/postgres-migration/url