Corrects the rule I wrote two commits ago, which was wrong in the other
direction. I had said rows never belong in a migration. They do, whenever every
client needs them — a lookup table, reference data, a permission the code checks,
a default setting. Seeding those from a migration is the correct pattern, not a
workaround, and add_branches_view_all_permission is the example.

The repository is common ownership: it defines what every client gets. So the
only question worth asking is whether a change is for all clients or for one
specific client. All clients means the repo, and anything touching the database
goes in a migration whether it is schema or data. One client means SSH to that
instance and it never enters the repo — because a migration applies to every
tenant at once and cannot be scoped to one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>