feat(server): Phase 3: control store backend

[lan17]

Summary

This PR implements the server side of Phase 3 from the control store and versioning plan.

It adds the control store schema, seeds the default store in the migration, and wires the backend flows for publish, unpublish, browse, and clone on top of ControlService. It also enforces the policy we agreed on: published controls are catalog-only artifacts and cannot be attached directly to agents or policies.

Design and implementation plan:

• https://gist.github.com/lan17/6a08282243576f096626bb10996c024b

This PR is intentionally server-first. SDK and UI follow-up work is still separate.

What changed

• added the Phase 3 Alembic migration for control_stores, control_stores_controls, and controls.cloned_control_id
• seeded the default store in the migration rather than app startup
• extended ControlService to own publish, unpublish, clone, published browse, and store cleanup behavior
• added POST/DELETE /api/v1/control-stores/default/controls/{control_id}
• added GET /api/v1/control-stores/default/controls with cursor pagination and the constrained v1 filter surface
• added POST /api/v1/controls/{control_id}/clone
• enforced that published controls cannot be associated directly with agents or policies
• updated soft delete to remove store publication rows before tombstoning
• added server contract models and backend tests for store browse, clone provenance, association restrictions, and the migration
• updated the direct-table server test harness to seed the default store so test reality matches migrated reality

Validation

• uv run pytest server/tests/test_control_store.py server/tests/test_control_phase3_alembic_migration.py -q
• uv run pytest server/tests/test_controls.py server/tests/test_controls_additional.py server/tests/test_policies.py server/tests/test_policy_integration.py server/tests/test_agents_additional.py server/tests/test_control_versions.py server/tests/test_services_controls.py -q
• make server-test

Notes

This PR is stacked on top of Phase 1/2:

• feat(server): Phase 1-2: add runtime control version history #173

[codecov]

Codecov Report

❌ Patch coverage is 93.28622% with 19 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...rver/src/agent_control_server/services/controls.py	91.27%	13 Missing ⚠️
...ver/src/agent_control_server/endpoints/controls.py	93.61%	6 Missing ⚠️

📢 Thoughts on this report? Let us know!