fix(export): hoist partman registry fixtures into service package; graphile-llm collision; X-Api-Name lookup

[pyramation]

Summary

Three upstream fixes found while testing the export path against diligence-app-demo and agentic-db:

1. @pgpmjs/export — partman FK whack-a-mole, fixed at the root. Generated partman.sql fixtures (category = 'meta_registration') insert into metaschema_public.partition, FK-referencing the database/table/field identity rows that only exist in the meta/service package — so the app package could never deploy standalone. exportMigrations now hoists these registry fixtures out of the app package into the service package:

• isRegistryFixture(row): category === 'meta_registration' && content matches /\bmetaschema_public\./
• hoisted rows are appended after the migrate/* metaschema identity fixtures, with their original DDL deps rewritten as cross-package requires (<app-name>:<change>)
• the service package's control file now requires the app extension when any fixtures were hoisted

Packages now deploy cleanly in the natural app → service order; no more deploy-order workarounds in consumers. Regression test added in export-flow.test.ts (hoists meta_registration registry fixtures into the service package).

2. graphile-llm — embeddingText collision. LlmTextMutationPlugin synthesized a <field>Text companion input for every vector column, colliding with tables that have a physical embedding_text sibling (inflects to the same GraphQL name), which killed schema build. Synthesis is now skipped when a physical attribute already owns the companion name (checked both at mapping construction and in the input-field hook). Vector-only tables are unchanged; tests cover both shapes (notes table with physical embedding_text added to setup.sql).

3. graphql/server — X-Api-Name lookup no longer filters is_published. The private-header lookup did AND a.is_published = $3 with $3 = opts.api.isPublic — on the private server this meant only unpublished APIs were addressable, a carryover from the legacy is_public column. Per the routing-plane definition, is_published governs cross-scope route visibility, not internal addressability; X-Api-Name is a trusted internal selector (only honored when isPublic === false). The filter is dropped.

Tests: pgpm/export 163 passing (incl. new regression test), graphile-llm collision tests passing, graphql/server middleware tests passing, tsc clean.

Related: found via export testing in https://github.com/constructive-io/diligence-app-demo/pull/40 and constructive-io/agentic-db#38.

Link to Devin session: https://app.devin.ai/sessions/497b48aa78b845d39127371f6bf9d6de
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring