feat(02-01): add migration infrastructure with golang-migrate and embedded SQL

- RunMigrations applies versioned SQL files via golang-migrate + embed.FS (iofs)
- ErrNoChange handled correctly - not treated as failure
- Migration 0001 creates full current schema with CREATE TABLE IF NOT EXISTS
- All three tables (updates, tags, tag_assignments) with acknowledged_at and ON DELETE CASCADE
- Uses database/sqlite sub-package (modernc.org/sqlite, no CGO)
- go mod tidy applied after adding dependencies

pkg/diunwebhook/migrate.go

@@ -0,0 +1,36 @@
+package diunwebhook
+
+import (
+	"database/sql"
+	"embed"
+	"errors"
+
+	"github.com/golang-migrate/migrate/v4"
+	sqlitemigrate "github.com/golang-migrate/migrate/v4/database/sqlite"
+	"github.com/golang-migrate/migrate/v4/source/iofs"
+	_ "modernc.org/sqlite"
+)
+
+//go:embed migrations/sqlite
+var sqliteMigrations embed.FS
+
+// RunMigrations applies all pending schema migrations to the given SQLite database.
+// Returns nil if all migrations applied successfully or if database is already up to date.
+func RunMigrations(db *sql.DB) error {
+	src, err := iofs.New(sqliteMigrations, "migrations/sqlite")
+	if err != nil {
+		return err
+	}
+	driver, err := sqlitemigrate.WithInstance(db, &sqlitemigrate.Config{})
+	if err != nil {
+		return err
+	}
+	m, err := migrate.NewWithInstance("iofs", src, "sqlite", driver)
+	if err != nil {
+		return err
+	}
+	if err := m.Up(); err != nil && !errors.Is(err, migrate.ErrNoChange) {
+		return err
+	}
+	return nil
+}