fix(ledger): drop bundles.arb_id FK to remove cross-process write race

The Rust engine and Go executor each own one half of the trade-ledger
write surface and both run fire-and-forget through their own bounded
mpsc → writer task. There is no cross-process ordering between Rust's
'ARB PUBLISHED → insert_arb' and Go's 'bundle signed → insert_bundle';
under load the Go bundle insert lands first and the immediate FK check
fails. Self-review flagged this as CRIT 2 — it would surface as a
steady stream of bundle drops on every busy block and mask real ledger
health.

Drops bundles_arb_id_fkey via an idempotent migration so both writers
can race freely. Trade-off: a transient Rust connection blip can
produce an orphan bundle row; that is already metered as
aether_ledger_writes_total{op="insert_arb",result="err"}, and
downstream LEFT JOIN queries treat the NULL arb side as informative.
Comment in the migration spells out the future path (coordinator or
reconciliation worker) for re-adding the FK once cross-process
ordering exists.

Refs PR #122 self-review (CRIT 2).

Author: 0xfandom

migrations/0002_drop_bundles_arb_id_fk.sql

@@ -0,0 +1,29 @@
+-- Trade ledger — drop bundles.arb_id → arbs(arb_id) foreign key.
+--
+-- Why: the Rust engine writes `arbs` rows and the Go executor writes
+-- `bundles` rows independently, both fire-and-forget through their own
+-- bounded mpsc → writer task. There is no cross-process ordering guarantee
+-- between "ARB PUBLISHED → insert_arb" on the Rust side and "bundle signed
+-- + sent → insert_bundle" on the Go side; under load the Go bundle insert
+-- can land at Postgres before the Rust arb insert, and the FK fires
+-- immediately on row INSERT (Postgres FK checks are not deferred by
+-- default). Result: a measurable fraction of bundle rows would be dropped
+-- with `aether_ledger_writes_total{op="insert_bundle",result="err"}` on
+-- every busy block, masking real ledger health.
+--
+-- Trade-off: an `arbs` row may briefly fail to land (Rust connection
+-- blip), leaving an orphan bundle. Acceptable because:
+--   - both sides drop on failure with a counter, so orphans surface as
+--     `aether_ledger_writes_total{op="insert_arb",result="err"}` anyway,
+--   - downstream queries already do LEFT JOIN arbs ↔ bundles when both
+--     sides are persisted, NULL on the arb side is informative.
+--
+-- Future: re-add the FK once a coordinator (e.g. Rust writes first and
+-- signals Go via gRPC ack) provides ordering, or add a backfilling
+-- reconciliation worker that re-runs the missing arb inserts.
+--
+-- The constraint is dropped IF EXISTS so the migration is idempotent on a
+-- partially-applied database.
+
+ALTER TABLE bundles
+    DROP CONSTRAINT IF EXISTS bundles_arb_id_fkey;