fix(ci): load real KB password for host-side PI E2E

configs/.env.dev omits KB_DB_PASSWORD so Load kept the default
shared_kb_secret_pass; fall back to root .env so research can use KB.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/server/piagent_e2e_test.go

@@ -9,6 +9,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -51,6 +52,22 @@ func mergePiAgentE2EKbConfig(cfg *config.Config) {
 	if cfg.KbDbUser == "" {
 		cfg.KbDbUser = "regkb"
 	}
+	// configs/.env.dev often omits KB_DB_PASSWORD; Load then keeps the insecure default.
+	// Prefer process env, then root .env, so host E2E actually authenticates to :5432.
+	if v := strings.TrimSpace(os.Getenv("KB_DB_PASSWORD")); v != "" {
+		cfg.KbDbPassword = v
+	} else if cfg.KbDbPassword == "" || cfg.KbDbPassword == "shared_kb_secret_pass" {
+		if b, err := os.ReadFile(".env"); err == nil {
+			for _, line := range strings.Split(string(b), "\n") {
+				line = strings.TrimSpace(line)
+				if !strings.HasPrefix(line, "KB_DB_PASSWORD=") {
+					continue
+				}
+				cfg.KbDbPassword = strings.Trim(strings.TrimPrefix(line, "KB_DB_PASSWORD="), "\"'")
+				break
+			}
+		}
+	}
 	if cfg.KbDbPassword == "" {
 		cfg.KbDbPassword = envOr("KB_DB_PASSWORD", "kb_secret_pass")
 	}

internal/server/workflow_governance_full_none_piagent_pg_test.go

@@ -183,14 +183,16 @@ func TestWorkflowGovernance_PiAgent_PG_FullNoneMixedChain(t *testing.T) {
 			t.Fatalf("pi-agent %s HTTP %d: %s", taskKey, respTask.StatusCode, buf.String())
 		}
 		var taskRes struct {
-			Success   bool `json:"success"`
+			Success   bool   `json:"success"`
+			Error     string `json:"error"`
+			Message   string `json:"message"`
 			DocRecord *struct {
 				DocID string `json:"doc_id"`
 			} `json:"doc_record"`
 		}
 		_ = json.NewDecoder(respTask.Body).Decode(&taskRes)
 		if !taskRes.Success {
-			t.Fatalf("pi-agent %s failed", taskKey)
+			t.Fatalf("pi-agent %s failed: error=%q message=%q", taskKey, taskRes.Error, taskRes.Message)
 		}
 		docID := fmt.Sprintf("doc_proj%d_%s", projectID, taskKey)
 		if taskRes.DocRecord != nil && taskRes.DocRecord.DocID != "" {