fix: harden the two local-only CI steps against what a fresh runner never sees

The Postgres readiness probe now goes over TCP inside the container. The
image's entrypoint runs a temporary init-phase server on the unix socket
only, so a socket probe read ready before the real server listened on the
port the test connects to, and every run is a fresh container so the
window is there warm or not.

The website e2e step refuses when something already answers on :5001
(the step would otherwise test that server while its own died with
EADDRINUSE) and pins PORT=5001, since the website dev script honours an
exported PORT and the probe would wait out its two minutes.

framework-dev.md described the pg driver as linked under
test/pg/node_modules, the approach that was tried and did not satisfy
drizzle's resolution; it now describes the --no-save install the script
does, and the prerequisites name setsid and pgrep.

Claude-Session: https://claude.ai/code/session_0125BCU48L9AmmM1JbBKeyQe

Author: vivek7405

framework-dev.md

@@ -188,9 +188,9 @@ the root `npm test`, the in-repo app typechecks and suites plus the website
 boot-check, the Conventions group (`webjs check` and `webjs doctor` per in-repo
 app, the buildless-packages invariant, the em-dash scan), and the Postgres
 round-trip against a throwaway `postgres:16` container (`scripts/ci-postgres.sh`,
-which also installs the `pg` driver into a scratch prefix and links it under
-`test/pg/node_modules`, so the shared lock stays without it, the same posture
-the CI job takes). The Docker image build is its own top-level step after the
+which also installs the `pg` driver `--no-save` into the repo's own
+`node_modules` and refuses to do so through a symlinked one, so the shared lock
+stays without it, the same posture the CI job takes). The Docker image build is its own top-level step after the
 Gate, so `--only Gate` skips it on a routine run and a signoff run includes it.
 Each slot's output is replayed whole when it finishes, and the wall-clock is the
 longest slot rather than the sum. `npm run ci` runs the lot; `npm run ci --
@@ -223,9 +223,12 @@ container and the image build; the user must be in the `docker` group, or set
 `WEBJS_DOCKER` to the command that reaches a daemon, such as `sudo -n docker`
 or `podman`), the Playwright browsers (`npx playwright
 install chromium firefox webkit`), `puppeteer-core` (a root devDependency),
-`gh` with the signoff extension (the script installs it), and a shell that does
-NOT export `FORCE_COLOR` (it flips tsc to pretty output and reds two type
-guards that parse the plain format).
+`gh` with the signoff extension (the script installs it), `setsid` and `pgrep`
+(util-linux and procps, present on Linux and absent from a stock macOS: the
+website e2e step and the runner's interrupt test use them), and a shell that
+does NOT export `FORCE_COLOR` (it flips tsc to pretty output and reds two type
+guards that parse the plain format) or `PORT` (the website e2e step pins 5001
+itself, but nothing else in the list should be steered by it either).
 
 `gallery`, `examples/blog`, and `website` each declare their own shorter list
 (setup, then `webjs check` / `webjs doctor` / typecheck / tests two at a time)

scripts/ci-e2e-website.sh

@@ -19,14 +19,26 @@
 # - On a failure the server log is printed, so a boot failure, a build failure,
 #   or a 500 on /ui/button does not fail the step with its cause in a file
 #   nobody reads.
+# - Two things a fresh CI runner never had to guard against. A server ALREADY
+#   on :5001 (a machine that was just editing the website) would answer the
+#   probe first try while ours died with EADDRINUSE, and the step would report
+#   on that server rather than this tree, so it is refused. And the website's
+#   dev script is `webjs dev --port ${PORT:-5001}`, so a shell exporting PORT
+#   would put the server elsewhere and the probe would wait out its two
+#   minutes; the port is pinned.
 
 set -euo pipefail
 
 ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
 LOG="${TMPDIR:-/tmp}/webjs-ci-website-dev-$$.log"
 cd "$ROOT"
 
-setsid npm run dev --workspace=@webjsdev/website > "$LOG" 2>&1 < /dev/null &
+if curl -sf -o /dev/null http://localhost:5001/ui/button; then
+  echo "something already answers on :5001; stop it first, or this step tests that server instead of this tree" >&2
+  exit 1
+fi
+
+PORT=5001 setsid npm run dev --workspace=@webjsdev/website > "$LOG" 2>&1 < /dev/null &
 server_pid=$!
 trap 'rc=$?; if [ "$rc" -ne 0 ]; then echo "--- website dev server log ---"; tail -n 200 "$LOG" || true; fi; kill -- -"$server_pid" 2>/dev/null || true; rm -f "$LOG"; exit "$rc"' EXIT
 

scripts/ci-postgres.sh

@@ -52,12 +52,15 @@ $DOCKER run -d --rm --name "$NAME" \
   -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=webjs_test \
   -p "127.0.0.1:${PORT}:5432" postgres:16 >/dev/null
 
-# Same readiness probe the CI service container declares, up to ~50s.
+# The CI service container's readiness probe, up to ~50s, but over TCP: the
+# image's entrypoint first runs a temporary init-phase server on the unix
+# socket only, and a socket probe (no -h) reads ready there, before the real
+# server listens on the port the test connects to.
 for _ in $(seq 1 50); do
-  if $DOCKER exec "$NAME" pg_isready -U postgres >/dev/null 2>&1; then break; fi
+  if $DOCKER exec "$NAME" pg_isready -h 127.0.0.1 -U postgres >/dev/null 2>&1; then break; fi
   sleep 1
 done
-if ! $DOCKER exec "$NAME" pg_isready -U postgres >/dev/null 2>&1; then
+if ! $DOCKER exec "$NAME" pg_isready -h 127.0.0.1 -U postgres >/dev/null 2>&1; then
   echo "ci-postgres: postgres:16 did not become ready in time" >&2
   $DOCKER logs "$NAME" >&2 || true
   exit 1