ci: start postgres in the job container's netns instead of via services:

`services:` in gitea-runner v1.0.8 doesn't reliably wire a DNS entry for
the service into the job container's network — the previous attempt got
past PoolTimedOut only to fail with "Temporary failure in name resolution"
on the `postgres` hostname.

Switch to the sidecar-in-netns pattern: start a postgres:16-alpine container
with `--network container:$(cat /etc/hostname)`, which puts it in the same
network namespace as the job container. Both then see each other on
127.0.0.1:5432. This pattern is stable across runners regardless of the
runner's own network mode. Cleaned up at end via `if: always()`.

.github/workflows/ci.yml

@@ -22,23 +22,35 @@ jobs:
     needs: gates
     # Compile sqlx query! macros against the committed .sqlx cache (no DB needed).
     # Tests still need a live Postgres — locally cm-testkit reads CM_TEST_DATABASE_URL
-    # from .cargo/config.toml pointing at scripts/test-server.sh's host container;
+    # from .cargo/config.toml pointing at scripts/test-server.sh's host container.
-    # in CI the runner is on the act-runner_default docker network and can't reach
+    # In CI the runner is on the fleet's native act_runner (morpheus/tank/architect);
-    # host 127.0.0.1, so we provide a service and override the URL to its DNS name.
+    # each job runs inside its own container, so we start postgres in the same
+    # network namespace as the job container — both then reach each other on
+    # 127.0.0.1. `services:` was flaky at v1.0.8 (DNS name didn't resolve).
     env:
       SQLX_OFFLINE: "true"
-      CM_TEST_DATABASE_URL: postgres://postgres:postgres@postgres:5432/postgres
+      CM_TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/postgres
-    services:
-      postgres:
-        image: postgres:16-alpine
-        env:
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: postgres
-        ports:
-          - 5432:5432
-        options: --health-cmd "pg_isready -U postgres" --health-interval 5s --health-timeout 3s --health-retries 10
     steps:
       - uses: actions/checkout@v4
+      - name: Start postgres in the job's netns
+        run: |
+          set -euo pipefail
+          docker rm -f ci-pg >/dev/null 2>&1 || true
+          docker run -d --name ci-pg \
+            --network "container:$(cat /etc/hostname)" \
+            -e POSTGRES_PASSWORD=postgres \
+            -e POSTGRES_DB=postgres \
+            postgres:16-alpine >/dev/null
+          for i in $(seq 1 30); do
+            if docker exec ci-pg pg_isready -U postgres -q >/dev/null 2>&1; then
+              echo "postgres ready after ${i}s"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "postgres never became ready" >&2
+          docker logs ci-pg >&2 || true
+          exit 1
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: 1.96.0
@@ -52,6 +64,9 @@ jobs:
         run: cargo test --workspace
       - name: Air-gapped installer verify path
         run: ./ci/test-install.sh
+      - name: Cleanup postgres sidecar
+        if: always()
+        run: docker rm -f ci-pg >/dev/null 2>&1 || true
 
   frontend:
     runs-on: ubuntu-latest