refactor(infrastructure): delegate xatu migrations to xatu-cbt

[Savid]

Summary

xatu restructured its ClickHouse migrations into database-agnostic per-schema sets (xatu → default, observoor → observoor, admin → admin), each applied to its target database and tracked in its own schema_migrations_<set> table (hard cutover — the old flat layout and global schema_migrations are gone).

xcli used to re-implement migration-running itself (pointing golang-migrate at the flat deploy/migrations/clickhouse dir, single default db). That breaks against the new layout. Rather than duplicate the new per-set logic here, this PR delegates the whole xatu-migration step to the xatu-cbt binary, which now owns it.

What changed

• Start() now calls migrateXatu(ctx) instead of the in-tree runXatuMigrations. migrateXatu execs xatu-cbt infra migrate-xatu --xatu-ref <ref> (a new, CBT-free subcommand) against the local cluster.
• Deleted the duplicated migration implementation: runXatuMigrations, createXatuDatabases, applyXatuMigrationSet, parseXatuCBTEnv, and the xatuMigrationSet type/var.
• go mod tidy dropped the now-unused direct deps: golang-migrate/migrate, ClickHouse/clickhouse-go, joho/godotenv (and transitive ch-go).

Net: −210 / +25 lines across manager.go + go.mod/go.sum.

Why delegate instead of duplicate

The new per-set / per-database / schema_migrations_<set> logic now lives in exactly one place (xatu-cbt), which is also the component that clones the xatu repo and stands up the local xatu cluster. xcli keeps its per-network SetupNetwork loop unchanged. We use a dedicated migrate-xatu subcommand rather than xatu-cbt infra start --run-migrations, because the latter also runs CBT setup for a single network — which would conflict with xcli's multi-network orchestration.

Production safety

Unchanged and defense-in-depth:

• The delegated call stays behind the existing xatuSource == constants.InfraModeLocal guard, so hybrid/external mode (remote/production xatu) never triggers it.
• xatu-cbt's migrate-xatu applies the same local-only guard internally.
• CBT migrations always target localhost; the external URL only configures the distributed-table pointer inside the local nodes.

Config generation

No changes needed. The generated cbt.yaml still points external.defaultDatabase at default (where the xatu set lands) and transformations.defaultDatabase at the per-network db — both unchanged by the restructure (only how migrations are applied changed, not where tables live).

Testing

• go build ./..., go vet ./..., golangci-lint (new-from-rev) — clean.
• pkg/configgen tests pass.
• Exercised end-to-end via xcli lab up: infra start → migrate-xatu → per-network setup ran against the local 2-node clusters.

Dependency

⚠️ Requires the matching xatu-cbt PR (adds infra migrate-xatu + the database-agnostic migrations). Merge/deploy them together.

🤖 Generated with Claude Code