ci: run integration suite against pgvector service container

Integration tests were running locally only — CI never exercised
the 29 v3_*_test.go files under tests/integration/. This left the
session tenant-isolation + vault scan-arity bugs undetected until
a manual run this session.

Changes:
- tests/integration/v3_test_helper.go: testDB() now calls
  pg.InitSqlx(db) inside sharedDBOnce. Previously the test suite
  relied on whichever test ran first happening to call InitSqlx,
  so running with `-run <filter>` could segfault with a nil
  pkgSqlxDB. Removes the ordering-dependency land mine.
- .github/workflows/ci.yaml: add services.pg block running
  pgvector/pgvector:pg18 with pg_isready healthcheck, set
  TEST_DATABASE_URL at job level, and add a new "Integration
  tests" step after unit tests. Uses -timeout=180s (vs 90s unit)
  because the first test runs migrations from scratch.

Local integration suite: 2.9s. CI cold start expected ~30-60s
with image pull + migrations.

.github/workflows/ci.yaml

@@ -12,6 +12,28 @@ permissions:
 jobs:
   go:
     runs-on: ubuntu-latest
+    # Postgres service container for integration tests. pgvector/pgvector:pg18
+    # matches the local dev image (Makefile uses the same tag on port 5433).
+    # Healthcheck blocks the job until PG accepts connections, avoiding
+    # first-connection flakiness on cold runner starts.
+    services:
+      pg:
+        image: pgvector/pgvector:pg18
+        env:
+          POSTGRES_PASSWORD: test
+          POSTGRES_DB: goclaw_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 3s
+          --health-retries 10
+    env:
+      # tests/integration/v3_test_helper.go reads TEST_DATABASE_URL and runs
+      # migrations once via golang-migrate. Uses port 5432 (CI-clean) vs 5433
+      # for local dev (avoids clash with desktop Postgres installs).
+      TEST_DATABASE_URL: postgres://postgres:test@localhost:5432/goclaw_test?sslmode=disable
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -24,7 +46,14 @@ jobs:
       # -timeout=90s caps each test binary so a deadlocked test fails fast
       # instead of blocking CI for the 10-minute default. Race-heavy wave C
       # suites run in <20s, so 90s leaves ample breathing room.
-      - run: go test -race -timeout=90s -coverpkg=./... -coverprofile=coverage.out ./...
+      - name: Unit tests
+        run: go test -race -timeout=90s -coverpkg=./... -coverprofile=coverage.out ./...
+      # Integration suite runs against the `pg` service container above.
+      # Longer -timeout=180s because the first test runs migrations from
+      # scratch (can take 10-30s on a cold CI runner). Local full suite
+      # completes in <3s against a warm DB.
+      - name: Integration tests
+        run: go test -race -timeout=180s -tags integration ./tests/integration/
       - name: Coverage summary
         run: go tool cover -func=coverage.out | tail -1
 

tests/integration/v3_test_helper.go

@@ -16,6 +16,7 @@ import (
 	_ "github.com/jackc/pgx/v5/stdlib"
 
 	"github.com/nextlevelbuilder/goclaw/internal/store"
+	"github.com/nextlevelbuilder/goclaw/internal/store/pg"
 )
 
 const defaultTestDSN = "postgres://postgres:test@localhost:5433/goclaw_test?sslmode=disable"
@@ -58,6 +59,13 @@ func testDB(t *testing.T) *sql.DB {
 			return
 		}
 		m.Close()
+
+		// Initialize pg package's sqlx wrapper. Without this, any store
+		// method that uses pkgSqlxDB.SelectContext panics on nil deref if
+		// the test runs before any other test happens to call InitSqlx.
+		// Centralizing here removes the ordering-dependency land mine.
+		pg.InitSqlx(db)
+
 		sharedDB = db
 	})