test(ci): add Postgres integration lane + real run_maintenance guard

The unit suite can't catch sync/async API mismatches against SQLAlchemy (an
un-awaited execution_options passed green CI but failed at runtime: VACUUM 0/6).
Add a real-Postgres integration lane modelled on the family pattern (rules
6/79-82): a new CI 'integration' job with a postgres:16 service, bridge-IP
discovery, busybox-safe readiness wait, and 'alembic upgrade head', running
pytest -m integration. Non-gating, like the unit lane.

- tests/test_integration_db_maintenance.py: runs run_maintenance() and
  get_table_health() against real Postgres; asserts all allowlisted tables
  vacuum OK (the await regression makes this fail) and health reports real stats.
- pyproject: register the 'integration' marker.
- conftest: integration-marked tests use the real DATABASE_URL, not the stub.
- ci.yml: unit 'test' job now runs -m 'not integration'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/conftest.py

@@ -12,8 +12,14 @@ import pytest
 
 
 @pytest.fixture(autouse=True)
-def _isolate_env(monkeypatch):
-    """Prevent tests from accidentally reading production env vars."""
+def _isolate_env(request, monkeypatch):
+    """Prevent unit tests from accidentally reading production env vars.
+
+    Integration tests (marked `integration`) are skipped here: they must use the
+    real DATABASE_URL injected by the CI integration lane, not the fake one.
+    """
+    if request.node.get_closest_marker("integration"):
+        return
     monkeypatch.setenv("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/test")
     monkeypatch.setenv("SECRET_KEY", "test-secret-key")
     monkeypatch.setenv("OLLAMA_URL", "http://localhost:11434")

tests/test_integration_db_maintenance.py

@@ -0,0 +1,41 @@
+"""Real-Postgres integration tests for DB maintenance + health.
+
+These run only in the CI integration lane (a real Postgres service + schema
+built by `alembic upgrade head`). They exercise the actual async SQLAlchemy
+connection path that unit mocks cannot: the un-awaited
+`AsyncConnection.execution_options` regression (which made every VACUUM raise
+AttributeError, reporting 0/6) passes the unit suite but fails here.
+"""
+import pytest
+
+from scribe.services.db_maintenance import (
+    MAINTENANCE_TABLES,
+    get_table_health,
+    run_maintenance,
+)
+
+pytestmark = pytest.mark.integration
+
+
+@pytest.mark.asyncio
+async def test_run_maintenance_vacuums_real_tables():
+    summary = await run_maintenance()
+    assert summary["tables"], "no tables were vacuumed"
+    # Every allowlisted table exists after `alembic upgrade head`, so every
+    # VACUUM (ANALYZE) must succeed. With the un-awaited execution_options bug
+    # they would ALL fail with AttributeError — this is the guard.
+    failed = [t for t in summary["tables"] if not t["ok"]]
+    assert not failed, f"VACUUM failed for: {failed}"
+    assert {t["table"] for t in summary["tables"]} <= set(MAINTENANCE_TABLES)
+
+
+@pytest.mark.asyncio
+async def test_table_health_reports_real_stats():
+    health = await get_table_health()
+    assert health["db_bytes"] > 0
+    names = {t["table"] for t in health["tables"]}
+    # Core table built by migrations must show up in pg_stat_user_tables.
+    assert "notes" in names
+    for t in health["tables"]:
+        assert t["dead_pct"] >= 0
+        assert t["total_bytes"] >= 0