add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/005-mount-pgdata.sh

@@ -30,6 +30,15 @@ case "${1:-}" in
     mount "$MOUNTPOINT"   # via fstab entry - also validates it
     echo "    $dev mounted at $MOUNTPOINT (noatime, fstab entry added)"
     ;;
+  status)
+    src=$(findmnt -rn -o SOURCE "$MOUNTPOINT" 2>/dev/null || true)
+    want=$(findfs UUID="$DISK_UUID" 2>/dev/null || true)
+    [[ -n $src ]] || { echo "DRIFT $MOUNTPOINT not mounted"; exit 1; }
+    [[ $src == "$want" ]] || { echo "DRIFT $MOUNTPOINT mounted from $src (want $want)"; exit 1; }
+    grep -q "^UUID=$DISK_UUID $MOUNTPOINT " /etc/fstab \
+      || { echo "DRIFT fstab entry missing"; exit 1; }
+    echo "OK $src at $MOUNTPOINT + fstab entry"
+    ;;
   down)
     # sysmig rolls back in reverse order, so 006 (postgres) is already down
     if findmnt -rn "$MOUNTPOINT" >/dev/null; then umount "$MOUNTPOINT"; fi