Complete PostgreSQL acceptance tests

The CI test job runs the entire pytest suite against disposable databases on PostgreSQL 16. A successful run must have zero skipped tests. The local plain pytest command remains useful for a quick check, but its opt-in database skips are not release acceptance evidence.

Run the same gate locally against a dedicated loopback test PostgreSQL server:

export HEYAIRA_TEST_ADMIN_DATABASE_URL='postgresql://<test-user>@127.0.0.1:<test-port>/postgres'
python scripts/test_postgres.py

Inside the Bridge agent sandbox, which has no TCP, use the libpq Unix socket form instead: an empty host, the socket directory and an optional port as the only query options, for example postgresql://postgres@/postgres?host=/path/to/postgres-test/socket or ...?host=/path/to/postgres-test/socket&port=5433.

The runner accepts only a loopback maintenance database with no URL query options, or that socket form with a single absolute ?host= directory. A port written in the authority (postgres@:5433/postgres?host=...) is moved into the query, because asyncpg would otherwise read it as TCP and ignore ?host=. The runner then asks asyncpg's own DSN parser where it would connect and refuses anything but that one loopback host or socket. That comparison ignores host-name case (LOCALHOST), . and .. segments in the socket directory, and leading zeros in the port (05433 is sent as 5433). Each per-test database URL keeps the query and replaces only the database name (with_database_name() in tests/conftest.py does the same for tests that create their own databases). The test user needs permission to create and drop databases. It creates ten randomly named databases, assigns all current E2E connection variables, runs the full suite, rejects skipped tests, and drops only the databases created by that invocation in a finally block. Do not provide a production connection or use a tunnel to production. The runner never prints its credential-bearing connection URL.

The current matrix covers MCP document/runtime access, two-instance binding, OAuth binding, smoke scripts, summary/tag persistence, account agent catalog, Bridge enrollment/rotation, node-to-project isolation and supervised execution HTTP contracts. The synthetic Git provider does not need production GitHub credentials.

The same CI job also checks the generated MCP contract, documentation coverage, Runtime pins and website consent tests. The Documentation workflow owns the strict MkDocs build. A release still needs its exact-commit CI result and its separate authorized production canaries.