One-time migration from EACL v6 relationship storage to the v7 tuple model.

v6 stored one Datomic entity per relationship (7 datoms across
:eacl.relationship/* attributes). v7 stores each relationship as two
cardinality-many tuple datoms asserted directly on your domain entities:

  [:db/add <subject-eid>  :eacl.v7.relationship/subject-type+relation+resource-type+resource
   [<subject-type> <relation-eid> <resource-type> <resource-eid>]]
  [:db/add <resource-eid> :eacl.v7.relationship/resource-type+relation+subject-type+subject
   [<resource-type> <relation-eid> <subject-type> <subject-eid>]]

where <relation-eid> refers to the Relation schema entity, not the relation
name keyword.

Entry points:
- `migrate!` runs the whole migration end-to-end (see its docstring for the
  exact steps). It is idempotent and converges storage forward: verified v7
  tuples replace the v6 relationship entities in the same run.
- `assert-storage-compatible!` is a read-only legacy-source diagnostic.
  Ordinary clients require the subsequent storage 7-to-8 migration.


Flat v6 permissions are converted once to canonical expression entities.
Pass your SpiceDB schema string as {:schema ...} to validate and replace the
stored schema from source. Without it, migrate! deterministically converts
the stored union-only rows. `normalize-schema-entity-ids!` first gives
legacy schema entities the canonical :eacl/id handles the replacement needs.

Full walkthrough and edge cases:
docs/migration-v6-to-v7.md.

Permission-only released-v7 to v8 upgrade.

Relationship storage upgrades are a separate maintenance step. This
namespace never enumerates or rewrites them; only bounded schema-definition
rows are read and one atomic permission replacement is submitted.