add per-migration status case (read-only drift check), integrate into sysmig status

status convention: print one line, exit 0 OK / 1 DRIFT / 2 unknown (e.g.
needs root). sysmig status now shows [applied ✓/✗/?] per migration and
exits 1 on drift. DB checks fall back to peer auth when non-root.

migrations/008-create-db-iwanhae.sh

@@ -30,6 +30,20 @@ case "${1:-}" in
       echo "    database $DB created, owner $ROLE"
     fi
     ;;
+  status)
+    if [[ $EUID -eq 0 ]]; then
+      q() { runuser -u postgres -- psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    elif psql -d postgres -tAc 'SELECT 1' >/dev/null 2>&1; then
+      q() { psql -d postgres -v ON_ERROR_STOP=1 -tAc "$1"; }
+    else
+      echo "? needs root or peer DB access to verify"
+      exit 2
+    fi
+    row=$(q "SELECT pg_get_userbyid(datdba) FROM pg_database WHERE datname='$DB'")
+    [[ -n $row ]] || { echo "DRIFT database $DB does not exist"; exit 1; }
+    [[ $row == "$ROLE" ]] || { echo "DRIFT database $DB owner=$row (want $ROLE)"; exit 1; }
+    echo "OK database $DB exists, owner $ROLE"
+    ;;
   down)
     if ! db_exists; then
       echo "    database $DB does not exist - nothing to do"