fix(ci): close clean runner gaps

test/back/ql3CiCleanCheckoutContract.test.cjs

@@ -39,6 +39,7 @@ test('pins backend CI to the released Node line and bootstraps a clean checkout'
   assertOrdered(backend, [
     'pnpm install --frozen-lockfile --ignore-scripts',
     'cp .env.example .env',
+    'mkdir -p data/db',
     'pnpm rebuild @whyour/sqlite3',
     'pnpm build:back',
     'pnpm run build:packages:ql3',
@@ -47,6 +48,18 @@ test('pins backend CI to the released Node line and bootstraps a clean checkout'
   assert.doesNotMatch(backend, /if: matrix\.node == '24'/);
 });
 
+test('provisions every role required by the PostgreSQL migration stream', () => {
+  const postgres = jobSource('cluster-postgres', 'cluster-postgres-ha');
+  for (const role of [
+    'ql3_automation_manager',
+    'ql3_approval_manager',
+    'ql3_run_manager',
+    'ql3_package_manager',
+  ]) {
+    assert.match(postgres, new RegExp(`CREATE ROLE ${role} LOGIN PASSWORD`));
+  }
+});
+
 test('bootstraps jobs that previously depended on local modules or artifacts', () => {
   const serviceManager = jobSource(
     'service-manager-bridge',
@@ -99,9 +112,7 @@ test('rebuilds the only native legacy binding used by resource evidence', () =>
 });
 
 test('does not forward a literal separator into recovery evidence CLIs', () => {
-  const recovery = jobSource(
-    'cluster-plugin-package-recovery-e2e',
-  );
+  const recovery = jobSource('cluster-plugin-package-recovery-e2e');
   assert.doesNotMatch(
     recovery,
     /pnpm (?:test|audit):plugin-package-recovery-e2e:ql3 -- \\/,

test/back/ql3PostgresTlsRotationWorkflow.test.cjs

@@ -60,7 +60,21 @@ test('builds cluster-postgres before the standalone TLS rotation contract', () =
     'pg_stat_ssl',
     'pg_is_in_recovery()',
     "current_setting('transaction_read_only')",
+    'PostgreSQL container logs:',
   ]) {
     assert.ok(source.includes(required), `missing TLS evidence: ${required}`);
   }
+  assert.match(source, /const uid = process\.getuid\?\.\(\)/);
+  assert.match(source, /const gid = process\.getgid\?\.\(\)/);
+  const certificateTool = source.match(
+    /function runCertificateTool[\s\S]*?\n}\n/,
+  )?.[0];
+  assert.ok(certificateTool);
+  assert.match(certificateTool, /'--user',\s*`\$\{uid}:\$\{gid}`/);
+  assert.doesNotMatch(certificateTool, /'0:0'/);
+  assert.match(source, /'\/work\/server\.key',\s*'\/work\/active\.crt'/);
+  assert.match(
+    source,
+    /activateServerCertificate\(directory, generation\);\s*preparePostgresFileOwnership\(directory\);\s*docker\(\['kill'/,
+  );
 });