Function upgrade_data_lake_schema_v6 

pub async fn upgrade_data_lake_schema_v6(
    tr: &mut Transaction<'_, Postgres>,
) -> Result<(), Error>

Upgrades the data lake schema to version 6. Adds the audience column to ingestion_api_keys: the write audience a key is immutably bound to. Backfilled to 'public' before SET NOT NULL – every pre-existing row predates audience stamping, and public is the accurate description of its current, unstamped-and-visible-to-everyone state, not a new grant. No DEFAULT on the column: that would let a not-yet-upgraded analytics-web-srv keep inserting rows that silently take public, defeating the column’s fail-closed property. analytics_api_keys is untouched – its read-side mirror is read_audiences, a set-valued grant in the opposite direction.