Need a unique + non null constraint on this?

But this creates problems of its own... what happens to existing installations with duplicate agents?  We can't really bail out of the migration, so I think we need to resolve the duplication during the migration some how.

For authority_ids we got around this by appending a SecureRandom.hex string to any authority_id we found was duplicated.  Harder to see what to do here though... I guess we could append a text note to force uniqueness or something like that.

Happy to have a go at this if you're fed up and want to assign it to me :)