add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/001-create-swap.sh

@@ -25,6 +25,14 @@ case "${1:-}" in
     fi
     echo "    swap 2GB enabled + fstab entry + vm.swappiness=10"
     ;;
+  status)
+    swapon --show --noheadings 2>/dev/null | grep -q '^/swapfile ' \
+      || { echo "DRIFT /swapfile not active"; exit 1; }
+    grep -q '^/swapfile ' /etc/fstab || { echo "DRIFT fstab entry missing"; exit 1; }
+    swp=$(cat /proc/sys/vm/swappiness 2>/dev/null || echo '?')
+    [[ $swp == 10 ]] || { echo "DRIFT vm.swappiness=$swp (want 10)"; exit 1; }
+    echo "OK swap active + fstab entry, swappiness=10"
+    ;;
   down)
     swapoff /swapfile
     rm -f /swapfile