ci: refreeze the store/cockroach.rs pins, and add a tool that finds every site

The migration-probe test fix changed src/store/cockroach.rs, which is pinned in
two places (the reviewed runtime source manifest and the publication-reader
session-pinning assertion) plus a README mirror. Hand-chasing those sites has
now cost three CI round-trips this wave, so this adds
.fleet-recall/fleet/refreeze-source-pins.sh:

  refreeze-source-pins.sh           # report every stale pin (exit 1 if any)
  refreeze-source-pins.sh --apply   # refreeze them

It derives the sites structurally -- the manifest block carries its own paths,
and the CLI proof's <name>_source= assignments name theirs -- so a newly pinned
file is picked up automatically. It deliberately does NOT auto-apply: the whole
point of these pins is that a human looks at a security-boundary diff before it
lands, so the default run only reports and tells you which diffs to read.

The pinned change here is test-only (deriving the unknown-migration probe
version instead of hard-coding 19, plus a helper rename); no session pinning,
role, grant, or publication-reader logic changed.

Claude-Session: https://claude.ai/code/session_01BxEBa1v242Fo1AJJGftFnZ

Author: scottmeyer

deploy/cockroach/tests/README.md

@@ -190,7 +190,7 @@ unreviewed future reachability. Its exact SHA-256 inputs are `config.rs`
 `private_postgres.rs`
 `7718c15393872a139956732629c472d813a2a014395f943a5382191966162745`,
 `store/cockroach.rs`
-`e3fb646beee9b4d1e78eafef3654116f8cf2b36472dcafc50ecc5363c3164997`,
+`c31a9a8e1344d5961e4477817389bdd4ffa8df90f9b0bbdb82387e3dc6423648`,
 `ledger/cockroach.rs`
 `b8c3ffbd3dfe7a74f76a06815f317db3e79b3129adaa14e2da5bea43f60b069f`,
 `service.rs` `6f0c6874072baed1070204063ac65df0761eda2da862e51775ba85cc5a34b522`,

deploy/cockroach/tests/registry-activation-cli.sh

@@ -1431,7 +1431,7 @@ if ! publication_store_digest=$(shasum -a 256 "$publication_store_source" \
 fi
 assert_exact "frozen publication-reader session-pinning source digest" \
     "$publication_store_digest" \
-    'e3fb646beee9b4d1e78eafef3654116f8cf2b36472dcafc50ecc5363c3164997'
+    'c31a9a8e1344d5961e4477817389bdd4ffa8df90f9b0bbdb82387e3dc6423648'
 if ! publication_live_test_digest=$(shasum -a 256 "$publication_live_test_source" \
     | awk 'NR == 1 { print $1 }'); then
     fail "could not hash the publication-reader connected test"

deploy/cockroach/tests/runtime-role-grants.sh

@@ -966,7 +966,7 @@ reviewed_source_manifest=$(shasum -a 256 \
 expected_reviewed_source_manifest="768f70b2da57f0beca31687eaf763e8774b144d3b300d47f25bb5a2635e894ed  $repo_root/src/config.rs
 76224d95199b19cf12b52f623ece802b9c5d57abc57833c17de2ccd336db16be  $repo_root/src/main.rs
 7718c15393872a139956732629c472d813a2a014395f943a5382191966162745  $repo_root/src/private_postgres.rs
-e3fb646beee9b4d1e78eafef3654116f8cf2b36472dcafc50ecc5363c3164997  $repo_root/src/store/cockroach.rs
+c31a9a8e1344d5961e4477817389bdd4ffa8df90f9b0bbdb82387e3dc6423648  $repo_root/src/store/cockroach.rs
 b8c3ffbd3dfe7a74f76a06815f317db3e79b3129adaa14e2da5bea43f60b069f  $repo_root/src/ledger/cockroach.rs
 c885c07bce2caa310a2b9f1d8fd2aa49edc672c4184bb4b85a9e2018993f9cb1  $repo_root/src/service.rs
 ee1d0b5a13f1906c13cbd3e93d26196d7bdace91895d8d2302c440d66ec8ef53  $repo_root/src/application.rs