fix(ci): drop host port publish for PG services, connect via service DNS

Host port 5432 is occupied by a live deployment since ~2026-09-24; CI service
containers failed with 'Bind for 127.0.0.1:5432 failed: port is already allocated'.
Services are reachable inside the job network as 'postgres:5432' without publishing.

.github/workflows/ci.yml

@@ -17,8 +17,6 @@ jobs:
           POSTGRES_USER: app
           POSTGRES_PASSWORD: ci_secret_db_pass
           POSTGRES_DB: agent_system_ci
-        ports:
-          - 5432:5432
         options: >-
           --health-cmd "pg_isready -U app -d agent_system_ci"
           --health-interval 5s
@@ -37,17 +35,17 @@ jobs:
 
       - name: migration gate
         env:
-          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@localhost:5432/agent_system_ci?sslmode=disable
+          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
         run: go test -count=1 -run TestMigrationGate ./internal/db/...
 
       - name: go test (short)
         env:
-          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@localhost:5432/agent_system_ci?sslmode=disable
+          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
         run: go test -short -timeout 20m ./...
 
       - name: governance PG integration (no -short)
         env:
-          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@localhost:5432/agent_system_ci?sslmode=disable
+          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
         run: go test -count=1 -timeout 15m ./internal/server/ -run 'TestWorkflowGovernance_PG_|TestE2E_WorkflowGovernance'
 
       - name: arch-check (block cleared kinds)
@@ -62,8 +60,6 @@ jobs:
           POSTGRES_USER: app
           POSTGRES_PASSWORD: ci_secret_db_pass
           POSTGRES_DB: agent_system_ci
-        ports:
-          - 5432:5432
         options: >-
           --health-cmd "pg_isready -U app -d agent_system_ci"
           --health-interval 5s
@@ -82,7 +78,7 @@ jobs:
 
       - name: migrate and seed schema
         env:
-          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@localhost:5432/agent_system_ci?sslmode=disable
+          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
         run: go test -count=1 -run TestMigrationGate ./internal/db/...
 
       - name: pg_dump backup
@@ -95,7 +91,7 @@ jobs:
       - name: restore to fresh database and re-run migrations
         env:
           PGPASSWORD: ci_secret_db_pass
-          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@localhost:5432/agent_system_ci_restore?sslmode=disable
+          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci_restore?sslmode=disable
         run: |
           psql -h localhost -U app -d postgres -c "DROP DATABASE IF EXISTS agent_system_ci_restore;"
           psql -h localhost -U app -d postgres -c "CREATE DATABASE agent_system_ci_restore;"