-- pg_trickle 0.43.0 -> 0.44.0 upgrade migration
--
-- v0.44.0 — Security Hardening & Code Quality
--
-- Changes in this release:
--
--   A45-1:  IVM BEFORE trigger functions now use a restricted search_path
--             (no `public`) to prevent search_path shadowing of extension
--             internals. AFTER trigger functions retain `public` so user
--             delta SQL can resolve source table references.
--   A45-2:  Centralized SQL-builder helpers (src/sql_builder.rs) —
--             internal Rust change only, no SQL schema changes.
--   A45-3:  RLS bypass warning emitted when a stream table is created
--             over an RLS-enabled source table — runtime behaviour change,
--             no SQL schema changes.
--   A45-4:  Monitoring docker-compose credentials hardened — ops-only,
--             no SQL schema changes.
--   A45-5:  SECURITY DEFINER CI check in scripts/check_security_definer.sh -- nosemgrep: semgrep.sql.security-definer.present
--             — CI change only, no SQL schema changes.
--   A45-6:  docs/SECURITY_MODEL.md updated — docs change only.
--   A45-7:  CDC module decomposed into rebuild + polling submodules —
--             internal Rust refactor, no SQL schema changes.
--   A45-8:  CreateStreamTableOptions struct — internal Rust refactor.
--   A45-9:  Parser safety facade — internal Rust refactor.
--   A45-10: Scheduler structured warnings — internal Rust change.
--   A45-11: Milestone ID comment audit — internal Rust change.
--
-- Schema changes:
--   (none — this release contains only Rust-level and ops-level changes)
--
-- IVM trigger functions are dynamically created at CREATE STREAM TABLE time
-- and will use the new search_path rules automatically for any stream tables
-- created or recreated after the extension is updated.
-- Existing stream tables will have their trigger functions updated the next
-- time they are refreshed or when pgtrickle.repair_stream_table() is called.

-- This upgrade script is intentionally minimal: no new SQL objects are added
-- or removed in v0.44.0. The .so is updated in-place by ALTER EXTENSION.