Complete PostgreSQL acceptance tests

The CI test job runs the entire pytest suite against disposable databases on PostgreSQL 16. A successful run must have zero skipped tests. The local plain pytest command remains useful for a quick check, but its opt-in database skips are not release acceptance evidence.

Run the same gate locally against a dedicated loopback test PostgreSQL server:

export HEYAIRA_TEST_ADMIN_DATABASE_URL='postgresql://<test-user>@127.0.0.1:<test-port>/postgres'
python scripts/test_postgres.py

The runner accepts only a loopback maintenance database with no URL query options. The test user needs permission to create and drop databases. It creates ten randomly named databases, assigns all current E2E connection variables, runs the full suite, rejects skipped tests, and drops only the databases created by that invocation in a finally block. Do not provide a production connection or use a tunnel to production. The runner never prints its credential-bearing connection URL.

The current matrix covers MCP document/runtime access, two-instance binding, OAuth binding, smoke scripts, summary/tag persistence, account agent catalog, Bridge enrollment/rotation, node-to-project isolation and supervised execution HTTP contracts. The synthetic Git provider does not need production GitHub credentials.

The same CI job also checks the generated MCP contract, documentation coverage, Runtime pins and website consent tests. The Documentation workflow owns the strict MkDocs build. A release still needs its exact-commit CI result and its separate authorized production canaries.