feat(toolchain): flag + WorkSession toolchain columns + migration

ROBOCO_TOOLCHAIN_MATCH_ENABLED (default-off) gates the whole subsystem.
Adds work_sessions.toolchain_python / toolchain_status (nullable VARCHAR(20))
recording the interpreter the workspace was provisioned with and whether the
target's suite can be executed (ok | broken | unknown). Migration 042 verified
with a real upgrade head + downgrade -1 + re-upgrade on a throwaway Postgres.

tests/unit/test_toolchain_flag.py

@@ -0,0 +1,14 @@
+"""The toolchain-match subsystem is gated by a default-off flag."""
+
+from __future__ import annotations
+
+from roboco.config import Settings
+
+
+def test_toolchain_match_disabled_by_default() -> None:
+    assert Settings().toolchain_match_enabled is False
+
+
+def test_toolchain_match_reads_env(monkeypatch) -> None:
+    monkeypatch.setenv("ROBOCO_TOOLCHAIN_MATCH_ENABLED", "true")
+    assert Settings().toolchain_match_enabled is True