HV-1: Schema migration — TestRun columns + HumanVerification + FeatureConfidenceRollup

feature_id: FEAT-studio-qa

## Context

Parent: OPER-196 (Human Verification System).

Roll-forward-only additive migration in `packages/database/prisma/schema/qa.prisma`. Adds three columns to `TestRun`, one new `HumanVerification` model, one new `FeatureConfidenceRollup` model. `HumanVerification.probeText` is PHI-adjacent — the Marisol conditional sign-off from the PDT memo requires `/// @PHI` annotation + `redactPhi()` at the write path + `AuditLog READ_PHI` at every read path, all landing in the same PR. Missing any of the three flips the sign-off to a veto.

Reuse the `PhiHarmScan.humanVerdict/By/At` all-set-or-all-null CHECK-constrained trio pattern (`phi-guard.prisma:41-48`) for the `verifierId/verifiedAt` pair on `HumanVerification`.

`FeatureConfidenceRollup` mirrors the `CoverageCell` shape (`qa.prisma:139`): unique on (`teamId`, `projectId`, `featureId`, `buildSha`), indexed on (`teamId`, `projectId`, `status`).

## Goal

Migration lands green with schema-guard subagent green, phi-auditor green, and the three PHI safeguards verifiable via grep in the same PR.

## Acceptance Criteria

- `TestRun` gains: `humanVerificationRequired: Boolean @default(false)`, `humanVerificationCompletedAt: DateTime?`, `experienceScoreMedian: HumanExperienceScore?`
- New `HumanVerification` model with `id`, `testRunId`, `verifierId`, `verifiedAt`, `experienceScoreExpected: HumanExperienceScore`, `experienceScoreTimeSaving: HumanExperienceScore`, `correctnessVerdict: HumanCorrectnessVerdict`, `probeText: String? /// @PHI`, `responsePayload: Json`, CHECK constraint that verifierId/verifiedAt are both null or both set
- New `FeatureConfidenceRollup` model shaped like `CoverageCell`
- New enums: `HumanExperienceScore { BROKEN, MEH, GOOD, DELIGHTFUL }`, `HumanCorrectnessVerdict { CORRECT, WORKS_BUT_WRONG, BROKEN }`
- `redactPhi()` runs on `probeText` at the write endpoint
- `AuditLog` row written with `action: READ_PHI` at every read path of `probeText`
- Migration is roll-forward-only
- schema-guard, phi-auditor, migration-safety subagents all green