add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

README.md

@@ -10,17 +10,20 @@ via cloud-init.
 sudo bash /opt/sysmig/sysmig up        # apply all pending migrations (idempotent)
 sudo bash /opt/sysmig/sysmig down      # roll back the last migration
 sudo bash /opt/sysmig/sysmig down all  # roll back everything (reverse order)
-bash /opt/sysmig/sysmig status         # show status (no root required)
+bash /opt/sysmig/sysmig status         # history + drift check (exit 1 on drift)
 ```
 
-- Migrations: `migrations/NNN-name.sh`, receiving `up`/`down` as `$1`
+- Migrations: `migrations/NNN-name.sh`, receiving `up`/`down`/`status` as `$1`
 - Applied history: `/var/lib/sysmig/applied` - applied entries never re-run
 - On failure the run aborts at that step; earlier steps stay applied
+- `status` runs each applied migration's read-only drift check (exit 1 on
+  drift); DB checks need root, otherwise shown as `?`
 
 ## Adding a new migration
 
 1. Create `migrations/NNN-name.sh` (number higher than existing; leave gaps)
-2. Implement both `up` and `down` cases - both must actually work
+2. Implement `up`, `down` and `status` cases - up/down must actually work;
+   `status` is a read-only check (exit 0 OK / 1 DRIFT / 2 unknown)
 3. Commit & push, then on the server: `git pull && sudo bash sysmig/sysmig up`
 
 ## cloud-init integration