test+arch: unblock production gate (import SSOT + isolated test DSN)

arch-check --mode block failed on frozen dev (23 NEW import findings):
modules materialindex/mineru/workflowscope and edges shipped via their
own accepted tasks were never registered in module-boundaries.yaml.
Register the intentional allowlist edges (precedent 97b868a9); no new
exceptions are added.

7 PG tests fell back to a hardcoded dev DB (127.0.0.1:5433) when
TEST_DATABASE_URL/CONTEXT_DB_DSN were unset, contradicting the isolated
test-DB contract (BUG-08) and polluting dev on a bare 'go test -short'.
Change the fallback to skip when no isolated DB env is provided.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/taskrun/store_lease_pg_test.go

@@ -16,7 +16,8 @@ func openLeaseTestPool(t *testing.T) *pgxpool.Pool {
 	t.Helper()
 	dsn := os.Getenv("TEST_DATABASE_URL")
 	if dsn == "" {
-		dsn = "postgres://app:dev_secret_db_pass@127.0.0.1:5433/agent_system_dev?sslmode=disable"
+		t.Skip("TEST_DATABASE_URL must be set for PostgreSQL integration tests (refusing default dev database)")
+		return nil
 	}
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	defer cancel()