feat(bell): add alert acknowledgement vertical slice

deploy/postgres/tests/assertions.sql

@@ -71,7 +71,7 @@ BEGIN
        OR NOT has_table_privilege('sense_app', 'sense.device_operation_outbox', 'DELETE') THEN
         RAISE EXCEPTION 'sense_app lacks access to its local audit Outbox';
     END IF;
-    IF (SELECT max(version) FROM bell.schema_migrations) <> 5
+    IF (SELECT max(version) FROM bell.schema_migrations) <> 6
        OR (SELECT max(version) FROM sense.schema_migrations) <> 6 THEN
         RAISE EXCEPTION 'schema migration version drift';
     END IF;
@@ -254,3 +254,24 @@ BEGIN
     END IF;
 END
 $event_ingress$;
+
+DO $bell_alerts$
+DECLARE
+    target text;
+BEGIN
+    FOREACH target IN ARRAY ARRAY[
+        'bell.rule_versions', 'bell.event_rule_sweeps', 'bell.rule_evaluations',
+        'bell.alerts', 'bell.alert_events', 'bell.alert_transitions',
+        'bell.alert_command_receipts'
+    ] LOOP
+        IF NOT has_table_privilege('yovision_t015_bell', target, 'SELECT,INSERT')
+           OR has_table_privilege('yovision_t015_bell', target, 'UPDATE,DELETE,TRUNCATE') THEN
+            RAISE EXCEPTION 'Bell runtime violates append-only Alert privilege on %', target;
+        END IF;
+        IF has_table_privilege('public', target, 'SELECT,INSERT,UPDATE,DELETE,TRUNCATE')
+           OR has_table_privilege('sense_app', target, 'SELECT,INSERT,UPDATE,DELETE,TRUNCATE') THEN
+            RAISE EXCEPTION 'Bell Alert history leaked on %', target;
+        END IF;
+    END LOOP;
+END
+$bell_alerts$;