ci: derive postgres URL inline in test step

$GITHUB_ENV env-file writes appear to be dropped between steps under
act_runner v1.0.8 (tests pass locally with the same postgres setup, but
CI keeps failing at cargo test after ~3 min — consistent with the tests
trying to reach 127.0.0.1:54331 from .cargo/config.toml because the URL
override never landed).

Fix: re-inspect the sidecar container in the test step and export
CM_TEST_DATABASE_URL right before `cargo test`. PG_CONTAINER (just a
container name) still comes through $GITHUB_ENV — if that also fails
we'll surface it cleanly. Echoing the derived URL so we can verify from
runner logs on the next go-round.

.github/workflows/ci.yml

@@ -72,7 +72,16 @@ jobs:
       - name: Clippy
         run: cargo clippy --workspace --all-targets -- -D warnings
       - name: Test
-        run: cargo test --workspace
+        run: |
+          set -euo pipefail
+          # Re-derive the postgres URL inline instead of trusting that
+          # CM_TEST_DATABASE_URL propagated through $GITHUB_ENV — act_runner
+          # v1.0.8 has been observed to swallow env-file writes here.
+          IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG_CONTAINER")
+          [ -n "$IP" ] || { echo "no PG IP" >&2; exit 1; }
+          export CM_TEST_DATABASE_URL="postgres://postgres:postgres@${IP}:5432/postgres"
+          echo "using $CM_TEST_DATABASE_URL"
+          cargo test --workspace
       - name: Air-gapped installer verify path
         run: ./ci/test-install.sh
       - name: Cleanup postgres sidecar