ci: the integration lane finds its own Postgres, not another job's

Run 8653 failed at 'alembic upgrade head' with a password error: two
integration jobs were on the runner at once, and the name=integration
filter took the other one's database (#5312). The lookup is now scoped to
this job's GITEA-ACTIONS-TASK-<id>- prefix, read from the job container's
own name, and requires exactly one match.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -249,8 +249,14 @@ jobs:
           set -eux
           echo "=== container landscape (diagnostic for the name filter) ==="
           docker ps -a --format '{{.ID}} {{.Image}} -> {{.Names}}'
-          PG=$(docker ps --filter "name=integration" --filter "ancestor=postgres:16-alpine" -q | head -n1)
-          test -n "$PG"
+          # Only THIS job's Postgres. Other repos' integration jobs share the runner, and
+          # `name=integration` alone once picked one of theirs (run 8653: a different
+          # password). act names a job's containers GITEA-ACTIONS-TASK-<task id>-..., and
+          # the job container's hostname is its own container id.
+          TASK=$(docker inspect -f '{{.Name}}' "$(cat /etc/hostname)" | sed -n 's|^/\(GITEA-ACTIONS-TASK-[0-9]*-\).*|\1|p')
+          test -n "$TASK"
+          PG=$(docker ps --filter "name=$TASK" --filter "ancestor=postgres:16-alpine" -q)
+          test "$(echo "$PG" | wc -w)" -eq 1
           PG_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$PG")
           test -n "$PG_IP"
           export INKWELL_DATABASE_URL="postgresql+asyncpg://inkwell:ci_integration@${PG_IP}:5432/inkwell_test"