meta migrate / meta verify: --entities (package) scope filter for the DB rail #253

Follow-up from #248 (PR #249), design spec §9d.

ResolvedGenConfig has an entities filter, so the codegen rail can be scoped to a package. ResolvedMigrateConfig and VerifyFlags have no equivalent, so the DB rail (meta migrate, meta verify --db) cannot be package-scoped. #248 removed the acute need in the reported case (phantom tables are gone), leaving this as ergonomics for large multi-package models.

Real design surface that gen-scoping doesn't have: a scoped expected schema diffed against a full DB proposes DROP TABLE for every out-of-scope table unless the scope also filters the actual side (and the snapshot ledger, and the FK-graph cascade keying from #241). That both-sides-scoped diff semantics deserves its own design, not a rider on a patch. Ref: §9d.