core: prevent accidental edits to migration files by restricting agent access