fix(migrate-v2): reset auto-created messaging_group policy on re-run

If 1b-db is re-run after the v2 service has already started (e.g.
recovering from an earlier failure), the messaging_group it would
otherwise create may already exist — auto-created by the runtime router
on the first inbound message, with the router's default
unknown_sender_policy ('request_approval'), not the migration's intent
('public'). The previous reuse path skipped creation but never updated
the policy, so re-runs left the bot hanging every message waiting for
an approver that wasn't seeded yet.

When reusing an existing row that has zero wired agent_groups (signal
of a router auto-create), reset the policy to 'public'. Once any wiring
exists, the user has had a chance to tighten via the skill — leave it.

Also adds a CHANGELOG entry covering this and the two sibling fixes
(Discord DM resolution, symlink skip in copyTree).

setup/migrate-v2/db.ts

@@ -22,7 +22,9 @@ import {
   createMessagingGroup,
   createMessagingGroupAgent,
   getMessagingGroupAgentByPair,
+  getMessagingGroupAgents,
   getMessagingGroupByPlatform,
+  updateMessagingGroup,
 } from '../../src/db/messaging-groups.js';
 import { runMigrations } from '../../src/db/migrations/index.js';
 import { readEnvFile } from '../../src/env.js';
@@ -147,7 +149,15 @@ async function main(): Promise<void> {
         ag = getAgentGroupByFolder(g.folder)!;
       }
 
-      // messaging_group — one per (channel_type, platform_id)
+      // messaging_group — one per (channel_type, platform_id).
+      //
+      // If the row already exists *and* has zero wired agent_groups, it
+      // was almost certainly auto-created by the runtime router on an
+      // inbound message (which uses 'request_approval' or similar — not
+      // the migration's 'public'). Reset its policy to match what the
+      // migration would have set if it had created the row first. Once
+      // any wiring exists, the user has had a chance to tighten the
+      // policy via the skill — leave it alone.
       let mg = getMessagingGroupByPlatform(channelType, platformId);
       if (!mg) {
         createMessagingGroup({
@@ -160,6 +170,12 @@ async function main(): Promise<void> {
           created_at: createdAt,
         });
         mg = getMessagingGroupByPlatform(channelType, platformId)!;
+      } else if (
+        mg.unknown_sender_policy !== 'public' &&
+        getMessagingGroupAgents(mg.id).length === 0
+      ) {
+        updateMessagingGroup(mg.id, { unknown_sender_policy: 'public' });
+        mg = getMessagingGroupByPlatform(channelType, platformId)!;
       }
 
       // messaging_group_agents — wire them