fix(migrations): make all ways of running migrations consistent on update [WIP]

[elcreator]

Changes

1 — every path applies the same migrations

1. core/database/migrations/2026_01_17_000000_fix_columns.php (new) — copy of the install-stub migration that widens active_user*.sid to 128. Previously make:site update/CMS (which run the core migrate) never applied it.
   Idempotent (->change()), anonymous class.
2. install/src/controllers/install.php and install/cli-install.php (update() + migrationAndSeed()) — run the core migrate (Console::call('migrate', ['--force' => true])) after seeding. This is the "have every path run the same
   migrate" option: installer-based installs/updates now pick up core-only migrations like 2026_04_12_..._create_system_cli_tasks_tables (the scheduler/worker tables the in-manager updater depends on), which they never created
   before.

I deliberately did not copy create_system_cli_tasks_tables verbatim into install/stubs: I verified its ACL-baseline repair would fire against the empty permission tables during a fresh installer migrate and then collide with
seed('install')'s explicit-id inserts. Running it after seeding (healthy baseline → repair self-skips) avoids that. Confirmed safe re: class redeclaration — Migrator::run (vendor/.../Migrator.php:131) only requires pending
migrations, so the shared CreateFileGroupsTable class is never declared twice in one process.

2 — make:site update runs the update seeders

3. core/src/Console/SiteUpdateCommand.php — new runUpdateSeeders() called after runCoreMigrations(), before the install dir is removed. It mirrors the installer's seed('update') (the permission renames in
   install/stubs/seeds/update/*), which the manager/CLI path previously skipped entirely.

Regression guard

4. core/tests/Unit/Install/UpdatePathConsistencyTest.php (new, 4 tests, all passing) — asserts post-baseline install migrations are mirrored into core, that fix_columns is in core, that both installers run the core migrate,
   and that the command applies the update seeders.

Test status

• My new test: 4/4 pass; FileGroupsSchemaAndModelTest: pass.
• Pre-existing failures unrelated to my diff (verified untouched vs HEAD): ManagerAclBaselineRepairTest (asserts a non-namespaced seeder string the migration doesn't use) and 3 SiteUpdateCommandTest cases (two are Windows
  escapeshellarg quoting "..." vs '...'; one is Undefined constant EVO_BASE_PATH in updatePlaceholderFilePairs(), a method I didn't modify, invoked without the constant defined). These fail on the unmodified tree too.

TBD
e2e update test - sandboxed update with local zip fixtures. Deterministic, no network, exercises the real migrate + seed + Extras logic. Requires adding test seams to the command:

• extract the three network calls into overridable methods — fetchTags(), downloadArchive($url), fetchReleases() — so a test subclass returns local fixtures (the command already favors many small protected methods, so this
  fits the style);
• override installComposerDependencies() to a no-op in the test (vendor is already present in the sandbox).

Flow: copy a minimal tree to a temp dir representing version N → install it against a temp SQLite DB → run the update with a N+1 zip fixture → assert. Fixtures only need the files the update touches (factory/version.php,
install/stubs/migrations + seeds/update, install/assets/modules/store.tpl, a couple of core files). Runs in seconds.