refactor: address PR review — rename, move helpers, add migration runner

Per review #320 comments:

- Rename _sv() → get_supervise_mod() in both store files (review 206/211)
- Move _audit_entry_from_row onto AuditStore as _row_to_entry static method
  (review 208); move _proposal/_response_from_row onto QueueStore (review 211)
- Remove _host_db_path() free function; inline into __init__ (review 209/211)
- Add stdlib migration runner using a shared schema_versions table; each store
  tracks its own version under a module key so they can coexist in the same DB
  without clobbering a shared PRAGMA user_version (reviews 210/212/213)
- PRD: add goal 6 (migration runner), narrow non-goal to third-party ORM only

docs/prds/prd-new-sqlite-local-storage.md

@@ -32,7 +32,8 @@ one-off persistence.
 4. The sidecar receives the host database mount across docker, smolmachines,
    and macOS-container backends.
 5. The implementation stays stdlib-only.
-6. Unit tests cover queue round-trips, pending discovery, response waits,
+6. Schema migrations use a `PRAGMA user_version` runner — no third-party deps.
+7. Unit tests cover queue round-trips, pending discovery, response waits,
    archive semantics, audit round-trips, and path creation.
 
 ## Non-goals
@@ -41,7 +42,7 @@ one-off persistence.
 - Adding forge orchestration state tables.
 - Adding egress metering or budget tables.
 - Changing the supervise TUI workflow or remediation behavior.
-- Introducing a third-party ORM or migration framework.
+- Introducing a third-party ORM or migration library.
 
 ## Design