add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/007-postgres-admin-role.sh

@@ -29,6 +29,20 @@ case "${1:-}" in
       "SELECT current_user || ' (superuser=' || rolsuper || ')' FROM pg_roles WHERE rolname = current_user")
     echo "    peer-auth check: $check"
     ;;
+  status)
+    if [[ $EUID -eq 0 ]]; then
+      q() { runuser -u postgres -- psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    elif psql -d postgres -tAc 'SELECT 1' >/dev/null 2>&1; then
+      q() { psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    else
+      echo "? needs root or peer DB access to verify"
+      exit 2
+    fi
+    row=$(q "SELECT rolsuper::text || '/' || rolcanlogin FROM pg_roles WHERE rolname='$ROLE'")
+    [[ -n $row ]] || { echo "DRIFT role $ROLE does not exist"; exit 1; }
+    [[ $row == true/true ]] || { echo "DRIFT role $ROLE super/login=$row (want true/true)"; exit 1; }
+    echo "OK role $ROLE exists: superuser + login"
+    ;;
   down)
     if role_exists; then
       if runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qc "DROP ROLE $ROLE"; then