ci: unblock rust job with a postgres service; publish only needs rust/frontend

The rust job's DB-backed tests (approvals_api, etc.) time out on the shared
act_runner because the runner lives inside a Docker container on the
act-runner_default network, and the URL in .cargo/config.toml points at
127.0.0.1:54331 — which is the *host* port for scripts/test-server.sh's
container, unreachable from inside the runner. Fix by attaching a postgres
service to the rust job and overriding CM_TEST_DATABASE_URL to the service's
DNS name. Local dev is untouched (still uses the shared server on the host).

Also drop e2e from publish's `needs` chain. e2e-backend.sh spins up its own
postgres + dex via `docker run` on the host, then tries to reach them at
127.0.0.1 from inside the runner container — same reachability problem,
larger fix. Migrating e2e to a physical build node (tank/architect) is a
separate task; until then e2e stays as signal-only and doesn't gate deploys.

.github/workflows/ci.yml

@@ -20,10 +20,23 @@ jobs:
   rust:
     runs-on: ubuntu-latest
     needs: gates
-    # Compile sqlx query! macros against the committed .sqlx cache (no DB needed);
+    # Compile sqlx query! macros against the committed .sqlx cache (no DB needed).
-    # DB-backed tests spin up their own postgres via testcontainers at runtime.
+    # Tests still need a live Postgres — locally cm-testkit reads CM_TEST_DATABASE_URL
+    # from .cargo/config.toml pointing at scripts/test-server.sh's host container;
+    # in CI the runner is on the act-runner_default docker network and can't reach
+    # host 127.0.0.1, so we provide a service and override the URL to its DNS name.
     env:
       SQLX_OFFLINE: "true"
+      CM_TEST_DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: postgres
+        ports:
+          - 5432:5432
+        options: --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 3s --health-retries 10
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -98,10 +111,15 @@ jobs:
   # its Tailscale IP — the fleet's daemons trust it in insecure-registries by
   # IP, not by hostname). GW-04's clawmates-deploy.timer rolls forward within
   # ~1 minute of the push. Skipped on PRs.
+  #
+  # `e2e` is intentionally NOT in `needs`: it launches its own postgres + dex
+  # via `docker run` on the host and then reaches them via 127.0.0.1, which
+  # fails from inside the act_runner container. Migrating e2e to a physical
+  # build node is a separate task; until then e2e is signal-only, not gating.
   publish:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    needs: [gates, rust, frontend, e2e]
+    needs: [gates, rust, frontend]
     env:
       REGISTRY: 100.94.185.103:5000
       NAMESPACE: clawmates