ci: start Postgres via docker run on localhost (services: not wired on runner)

The declarative services: Postgres was never reachable at postgres:5432 (P1001)
on this Gitea runner even with a valid healthcheck — service-name networking to
the job isn't wired here. Switch to the mdm CI pattern: host-mode runner, start
pgvector via 'docker run -p 5434:5432', connect over localhost:5434 (also the
specs' default DATABASE_URL). Clean up the container in always().

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -7,32 +7,13 @@ on:
 
 jobs:
   build:
+    # Host-mode runner (docker talks to the host daemon). We publish a pgvector
+    # Postgres to localhost:5434 and connect over localhost — the service-name
+    # networking of `services:` containers is not wired to jobs on this runner,
+    # so we start the DB explicitly (same proven pattern as the mdm CI).
     runs-on: dind-builder
-    # Clean Ubuntu with Node tooling; proven on this runner (matches go-monorepo CI).
-    # A job container is required so the `services:` Postgres is reachable by its
-    # service name (`postgres`) on the shared job network.
-    container:
-      image: catthehacker/ubuntu:act-latest
-
-    # pgvector Postgres for the DB-backed *.spec.ts integration suites. The specs
-    # read DATABASE_URL (set below) and fall back to localhost:5434 for local
-    # `docker compose` dev; in CI they connect to this service at postgres:5432.
-    services:
-      postgres:
-        image: pgvector/pgvector:pg16
-        env:
-          POSTGRES_USER: iios
-          POSTGRES_PASSWORD: iios
-          POSTGRES_DB: iios
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
-
     env:
-      DATABASE_URL: postgresql://iios:iios@postgres:5432/iios?schema=public
-
+      DATABASE_URL: postgresql://iios:iios@localhost:5434/iios?schema=public
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -42,6 +23,21 @@ jobs:
         with:
           node-version: 22
           cache: pnpm
+
+      # pgvector Postgres for the DB-backed *.spec.ts integration suites.
+      - name: Start pgvector Postgres
+        run: |
+          docker rm -f iios-ci-pg-${{ github.run_id }} >/dev/null 2>&1 || true
+          docker run -d --name iios-ci-pg-${{ github.run_id }} \
+            -e POSTGRES_USER=iios -e POSTGRES_PASSWORD=iios -e POSTGRES_DB=iios \
+            -p 5434:5432 pgvector/pgvector:pg16
+          for i in $(seq 1 30); do
+            docker exec iios-ci-pg-${{ github.run_id }} pg_isready -U iios >/dev/null 2>&1 && break
+            sleep 2
+          done
+          docker exec iios-ci-pg-${{ github.run_id }} pg_isready -U iios \
+            || { echo "Postgres did not become ready"; exit 1; }
+
       - run: pnpm install --frozen-lockfile
       - run: pnpm boundary
       # iios-service uses Prisma: generate the client so its generated types
@@ -57,3 +53,7 @@ jobs:
       # (reset-db.ts TRUNCATEs existing tables; migrations must exist first).
       - run: pnpm --filter @insignia/iios-service exec prisma migrate deploy
       - run: pnpm test
+
+      - name: Stop Postgres
+        if: always()
+        run: docker rm -f iios-ci-pg-${{ github.run_id }} >/dev/null 2>&1 || true