feat(datastore): add container datastore and OCI local migrations (MR 2/5)

Why

Layer 1 (database) of the S12 OCI-local stack. The datastore package and the two SQL migrations that establish the container/OCI schema (manifests, tags, blob references, repositories).

This MR cannot land before MR-1 because:

• cas, format/oci, and namespace all import datastore.
• Migrations and the Go data-access code ship together so a deploy that runs migrations matches the code that queries the resulting schema.

Issue: #19 Spec: S12 (already merged via !48 (merged))

Stack and merge order

#	MR	Branch	Targets	Blocks
0	!141 (merged)	19-oci-boilerplate	main	!124 (closed)
1	!124 (closed)	19-oci-foundation	19-oci-boilerplate	!125 (closed)
2	!125 (closed) ← you are here	19-oci-database	19-oci-foundation	!126 (closed)
3	!126 (closed)	19-oci-cas	19-oci-database	!127 (closed)
4	!127 (closed)	19-oci-format	19-oci-cas	!128 (closed)
5	!128 (closed)	19-oci-wiring	19-oci-format	n/a

What's in MR-2

13 files, ~4,200 insertions, all Go code and SQL.

• internal/datastore/: Container, Repository, Namespace, Upload, and BlobStorage data-access. Everything pgx-based. Integration tests cover happy paths and concurrent contention. Unit tests cover mapping and pure logic.
• internal/datastore/migrations/sql/: two ordered migrations:
  • 20260428120000_oci_local_schema_root.sql: namespaces, repositories, blobs.
  • 20260428120100_oci_local_schema_container.sql: container repositories, manifests, tags, blob references, manifest references, layers, uploads.
• internal/datastore/migrations/migrations_test.go: round-trip migration test (apply, revert, re-apply).

go.mod adds github.com/google/uuid as a direct dependency for manifest revision IDs.

Test plan

• CI green on this MR (build, vet, lint, unit + integration tests, lint:migration-ordering, lint:migrations).
• test:integration activates (changes match internal/datastore/**) and the migration round-trip plus Container integration tests pass against the postgres service.
• lint:migration-ordering confirms the two new SQL files extend the (currently empty) target-branch migration set without ordering violations.
• go mod tidy is a no-op locally.
• !126 (closed) builds cleanly on top of this branch.