docs: add DBA grant script and Phase 1 VersionSet approval checklist

- scripts/dba/grant-migration-test-db-ownership.sql: for a DBA to run,
  fixes the kartsell_migration_test ownership regression blocking
  DbUpMigrationTests/DbUpRecoveryTests (12 tests) locally.
- docs/CURRENT/PHASE-1_APPROVAL_CHECKLIST.md +
  scripts/phase1/template-approve-versionset.sql: documents/templates the
  human maker-checker approval steps needed to freeze a VersionSet before
  Phase 1 shadow run can be re-queued. Does not perform any approval —
  every placeholder must be filled by a real, named maker and a different
  named checker. No automation should insert rows into dataset_manifest /
  model_version_registry / evidence_snapshot / release_evidence_bundle.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/dba/grant-migration-test-db-ownership.sql

@@ -0,0 +1,30 @@
+-- DEBT: AEG-X-004 regression (2026-08-07) — see docs/CURRENT/CATALOGS/WBS_PROGRESS_TRACKER.csv row AEG-X-004
+--   and CURRENT_ROADMAP.md "알려진 문서 정합성 문제" #2.
+--
+-- Symptom: 12 DbUpMigrationTests (Migration0008/0009/0010/0032) fail locally with
+--   Postgres 42501 "must be owner of database kartsell_migration_test" — the `kartsell`
+--   DB user can no longer DROP+CREATE that database, which the fresh/upgrade/re-run
+--   rehearsal requires.
+--
+-- Run this as a Postgres superuser (or the role that currently owns kartsell_migration_test)
+-- against the target server, NOT as the `kartsell` application user (it cannot grant itself
+-- ownership of a database it does not already own).
+--
+-- Usage:
+--   psql -h <host> -p 5432 -U <superuser> -d postgres -f scripts/dba/grant-migration-test-db-ownership.sql
+
+ALTER DATABASE kartsell_migration_test OWNER TO kartsell;
+
+-- If the database does not exist yet on this server, create it first, then re-run the ALTER
+-- above (CREATE DATABASE already makes the creating role the owner, so the ALTER becomes a
+-- no-op in that case):
+--   CREATE DATABASE kartsell_migration_test OWNER kartsell;
+
+-- Verify:
+--   SELECT datname, pg_catalog.pg_get_userbyid(datdba) AS owner
+--   FROM pg_database WHERE datname = 'kartsell_migration_test';
+-- Expected: owner = kartsell
+
+-- After this grant, re-run the isolated rehearsal to confirm:
+--   dotnet test --filter "FullyQualifiedName~DbUpMigrationTests" -c Release
+--   dotnet test --filter "FullyQualifiedName~DbUpRecoveryTests" -c Release

scripts/phase1/template-approve-versionset.sql

@@ -0,0 +1,71 @@
+-- Phase 1 Shadow Run — VersionSet approval TEMPLATE.
+-- See docs/CURRENT/PHASE-1_APPROVAL_CHECKLIST.md before touching this file.
+--
+-- THIS IS NOT A SCRIPT TO RUN AS-IS. Every :placeholder below must be filled in by a real
+-- person who actually reviewed the referenced evidence. Do not fill these in programmatically,
+-- from a template default, or because "the checklist items are all checked" — the checker must
+-- be a different person from the maker, and both must be named humans who can be held
+-- accountable for the decision. Running this file IS the approval action.
+--
+-- Usage: fill in every :placeholder, remove this comment block, then run interactively:
+--   psql "$KARTSELL_POSTGRES" -f scripts/phase1/template-approve-versionset.sql
+-- Do not run non-interactively / in CI / from a job.
+
+begin;
+
+-- 1) Dataset manifest: propose, then (as a DIFFERENT session/person) approve + freeze.
+insert into evaluation.dataset_manifest
+    (dataset_id, scope_key, content_hash, source_catalog_version, lineage_hash, status, frozen_at)
+values
+    (:'dataset_id', :'scope_key', :'content_hash', :'source_catalog_version', :'lineage_hash',
+     'PROPOSED', now());
+
+-- -- Run as a SEPARATE step by the checker, after real review, not in the same transaction:
+-- update evaluation.dataset_manifest
+--    set status = 'APPROVED', approved_by = :'checker_name', approved_at = now()
+--  where dataset_id = :'dataset_id';
+-- -- table is append-only after that point; freezing requires a new row, not an UPDATE to FROZEN
+-- -- (see db/migrations/0034_dataset_manifest_freeze_contract.sql trigger) — insert a follow-up
+-- -- row with status = 'FROZEN' and the same content_hash lineage instead.
+
+-- 2) Model version registry.
+insert into governance.model_version_registry
+    (model_version, scope_key, config_version, code_sha, contract_version, lifecycle_state,
+     effective_at, model_card_hash)
+values
+    (:'model_version', :'scope_key', :'config_version', :'code_sha', :'contract_version',
+     'CANDIDATE', now(), :'model_card_hash');
+
+-- -- Checker step, separately, after real review:
+-- update governance.model_version_registry
+--    set lifecycle_state = 'APPROVED', approved_by = :'checker_name', approved_at = now()
+--  where model_version = :'model_version' and scope_key = :'scope_key' and effective_at = :'effective_at';
+
+-- 3) Evidence snapshot (references the approved dataset + model version above).
+insert into signal_engine.evidence_snapshot
+    (evidence_id, as_of, published_at_cutoff, dataset_id, data_hash, model_version,
+     config_version, payload, content_hash)
+values
+    (:'evidence_id', now(), :'published_at_cutoff', :'dataset_id', :'data_hash',
+     :'model_version', :'config_version', :'payload_json'::jsonb, :'content_hash');
+
+-- 4) Release evidence bundle — maker creates, a DIFFERENT checker approves.
+insert into governance.release_evidence_bundle
+    (bundle_id, release_version, source_manifest_hash, build_artifact_hash, test_artifact_hash,
+     migration_artifact_hash, security_artifact_hash, rollback_artifact_hash, decision_log_hash,
+     status, maker_id, created_at, content_hash)
+values
+    (gen_random_uuid(), :'release_version', :'source_manifest_hash', :'build_artifact_hash',
+     :'test_artifact_hash', :'migration_artifact_hash', :'security_artifact_hash',
+     :'rollback_artifact_hash', :'decision_log_hash', 'REVIEW_REQUIRED', :'maker_name', now(),
+     :'bundle_content_hash');
+
+-- -- Checker step, separately, after real review (checker_id must differ from maker_id — enforced
+-- -- by CHECK constraint):
+-- update governance.release_evidence_bundle
+--    set status = 'APPROVED', checker_id = :'checker_name', decided_at = now()
+--  where bundle_id = :'bundle_id';
+
+-- Do not COMMIT this transaction until you are the maker completing steps above as one unit.
+-- The checker updates are separate transactions run later by a different person.
+commit;