add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/006-install-postgres.sh

@@ -50,6 +50,18 @@ EOF
     fi
     pg_lsclusters --no-header
     ;;
+  status)
+    command -v pg_lsclusters >/dev/null 2>&1 \
+      || { echo "DRIFT postgresql-common not installed"; exit 1; }
+    line=$(pg_lsclusters --no-header | awk -v v="$PGVER" '$1==v' | head -1)
+    [[ -n $line ]] || { echo "DRIFT no PG $PGVER cluster"; exit 1; }
+    read -r _ name _ st _ datadir _ <<<"$line"
+    [[ $st == online ]] || { echo "DRIFT cluster $PGVER/$name is '$st'"; exit 1; }
+    [[ $(findmnt -rn -o TARGET -T "$datadir") == "$PGROOT" ]] \
+      || { echo "DRIFT $datadir not on $PGROOT"; exit 1; }
+    [[ -f $SRC ]] || { echo "DRIFT PGDG repo file $SRC missing"; exit 1; }
+    echo "OK PG $PGVER/$name online, data on $PGROOT, PGDG repo present"
+    ;;
   down)
     { pg_lsclusters --no-header 2>/dev/null || true; } | while read -r ver name _; do
       pg_ctlcluster "$ver" "$name" stop 2>/dev/null || true