chore: sync main into PR 1864 branch

[BigSimmo]

Mechanical late branch sync for #1864 after required CI completed. This merges the current main tip into codex/tools-results-mode-mockup so the reviewed PR is tested against the latest base. No independent product scope.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c1e2016a-c08f-4219-a60b-cca3306da548

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[BigSimmo]

Final review-and-fix summary

Final state and integration

• Repository: BigSimmo/Database
• PR: chore: sync main into PR 1864 branch #1871 — chore: sync main into PR 1864 branch
• State: already merged and closed before this review began
• Final PR head: be5c7f5a082ea4b865ff07ef7dd77330f3f86a1a (main)
• Base at merge: 987918e609ffe571f631a22e75df0bf11c4fc898 (codex/tools-results-mode-mockup)
• Merge commit: bcb39e52d764121b67e215c444a0a5ae7d9f2367
• Sync state: the signed merge commit has exactly the expected base and head parents. A prospective merge-tree is no longer applicable after merge. auto_merge is not armed.

Findings, fixes, and ledger

• The declared PR scope was a mechanical late sync of main, with no independent product scope.
• No post-merge code or documentation changes were made. No commits or pushes occurred.
• No actionable PR defect was identified in the final-state evidence.
• The branch-review ledger was inherited from main; no matching PR chore: sync main into PR 1864 branch #1871/Tools: add responsive results-mode mockup #1864/exact-head heavy-review record exists. No ledger-only commit was created, consistent with repository convention.
• Pre-existing or unrelated repository work was not modified.

Adversarial review and comments

• There are no review submissions and no inline review threads, so there were no actionable threads to reply to or resolve.
• The Supabase notice (supabase scope unchanged) and CodeRabbit notice (automatic review skipped because the target was not the default branch) are informational and dispositioned as non-actionable.
• CodeRabbit did not perform an adversarial review. A fresh post-merge code review was not run because the requested protocol requires final-state verification and stop when the PR is already merged.

Verification

• No local checkout or local tests were run because the PR was already merged. Verification used the immutable GitHub PR head and merge commit.
• All 106 exact-head check runs are completed. No failed, cancelled, timed-out, action-required, stale, or incomplete run was found. Outcomes include successes and intentional skips.
• Decisive successful checks include Gitleaks, Semgrep, Semgrep ingestion gate, build-and-verify, and Refresh PR mergeability after base push. PR mergeability was skipped after the completed integration.
• The active required-check ruleset applies only to the default branch. Because PR chore: sync main into PR 1864 branch #1871 targeted codex/tools-results-mode-mockup, no required checks applied to this PR. Exact-head PR required, PR policy, and Production UI runs are absent/not selected; they are not being described as green.
• Advisory commit statuses Database - worker, Database - Database, and Database - app succeeded.
• build-and-verify succeeded, including app and worker image builds, the image-content contract, provider-free app smoke, and network-isolated worker runtime validation.

Infrastructure residual and disposition

• Two advisory Trivy/SBOM steps could not download the vulnerability database because the GitHub runner lost external DNS/network access. These steps are explicitly non-blocking and the aggregate job succeeded.
• Residual risk: a complete exact-head worker SBOM and current HIGH/CRITICAL image vulnerability-scan result were not produced by that run.
• No permission blocker was encountered.
• No merge action was taken by this review. PR chore: sync main into PR 1864 branch #1871 had already been merged before this run, so “Final merge is left to the user” is no longer applicable.