fix(db): add the visibility constraint NOT VALID, then validate

check:migrations blocks a plain ADD CONSTRAINT CHECK on an existing
table: it takes an ACCESS EXCLUSIVE lock for a full scan of credential
and rejects concurrent writes for the duration. Split into the
expand/contract form so the lock is brief and validation runs under
SHARE UPDATE EXCLUSIVE, which readers and writers do not block on.

Author: mzxchandra

packages/db/migrations/0285_brainy_mauler.sql

@@ -1,3 +1,4 @@
 CREATE TYPE "public"."credential_env_visibility" AS ENUM('secret', 'variable');--> statement-breakpoint
 ALTER TABLE "credential" ADD COLUMN "env_visibility" "credential_env_visibility" DEFAULT 'secret' NOT NULL;--> statement-breakpoint
-ALTER TABLE "credential" ADD CONSTRAINT "credential_env_visibility_scope_check" CHECK ((env_visibility = 'secret') OR (type = 'env_workspace'));
+ALTER TABLE "credential" ADD CONSTRAINT "credential_env_visibility_scope_check" CHECK ((env_visibility = 'secret') OR (type = 'env_workspace')) NOT VALID;--> statement-breakpoint
+ALTER TABLE "credential" VALIDATE CONSTRAINT "credential_env_visibility_scope_check";