refactor(schema): fan desired-state schema out to one file per table (#8131)

schema/community_write_fence.sql

@@ -0,0 +1,31 @@
+-- Attach the universal fence to every existing table carrying community_id,
+-- including deployment-private sidecars whose community_id is provenance.
+--
+-- Desired-state schema application does not replay migration history, so the
+-- explicit `SELECT attach_community_write_fence('<table>')` calls in
+-- `triggers/<table>.sql` stay as first-class catalog declarations. They also
+-- make the fence contract visible to migration linting instead of hiding it
+-- only in this dynamic bootstrap loop. This loop runs last, so it fences every
+-- desired-state table regardless: a fenced desired state does not prove the
+-- migration path attaches the fence. Keep the explicit calls.
+DO $$
+DECLARE
+    target REGCLASS;
+BEGIN
+    FOR target IN
+        SELECT c.oid::REGCLASS
+          FROM pg_class c
+          JOIN pg_namespace n ON n.oid = c.relnamespace
+          JOIN pg_attribute a ON a.attrelid = c.oid
+         WHERE n.nspname = current_schema()
+           AND c.relkind IN ('r', 'p')
+           AND NOT c.relispartition
+           AND a.attname = 'community_id'
+           AND NOT a.attisdropped
+           AND NOT community_write_fence_excluded_table(c.relname)
+         ORDER BY c.oid::REGCLASS::TEXT
+    LOOP
+        PERFORM attach_community_write_fence(target);
+    END LOOP;
+END
+$$;