stash encrypt: no way to abandon a column migration that is still in progress #1221

Background

stash encrypt * moves an existing plaintext column to an encrypted column (a column migration). The steps are: add the encrypted column, have the app write both columns (dual-writing), fill the encrypted column (backfill), switch reads over (cutover), and drop the plaintext column. Each step is recorded in the cs_migrations table. stash decrypt * (#1193) is the reverse direction, used once a column is fully encrypted and the plaintext column has been dropped.

Problem

A team that starts encrypting a column and changes its mind before the drop has no supported way out. Today the only route is a reverse column migration started on top of the open forward one. #1193 allows that behind a "forward-source" warning. That leaves two open column migrations on the same pair of columns, which the follow-up design in #1217 rules out. Its reasoning is in ADR 0001 under languages/typescript/packages/migrate/docs/adr/. Once #1217 lands, a reverse column migration will be refused until the forward one is dropped. Teams in this position will then need a separate way out.

The reverse direction is also the wrong tool here. While dual-writing is live, the plaintext column is still current, so there is nothing to decrypt back into it.

Proposal

1. Add an abort operation, for example stash encrypt abort --table T --column C. It is allowed in any phase before the drop. It records an aborted phase in cs_migrations and prints the steps that follow: stop writing the encrypted column, switch reads back if cutover happened, then drop the encrypted column.
2. Generate the migration that drops the encrypted column, the same way stash encrypt drop generates its drop migration. Refuse when reads have been cut over to the encrypted column and the plaintext column has not been dual-written since.
3. Make stash status and stash encrypt status show aborted, and allow a new forward column migration to start after an abort.
4. Interim, before any of this: document in skills/stash-cli that a forward column migration still in progress cannot be reversed with stash decrypt, and list the manual steps.

Relationship to other work

• stash decrypt lifecycle rules are re-derived in each command — give the migration lifecycle one owning module #1217 introduces the "one open column migration per pair" rule that makes this necessary.
• feat(cli): reverse migration (stash decrypt) for moving columns back to plaintext #1193 adds the reverse direction.