fix(ci): unblock workflow-only PRs stuck on required Postgres check

[manavgup]

Problem

Postgres integration tests is a required status check on main, but postgres-integration.yml is path-filtered to src/**, tests/**, pyproject.toml, uv.lock. A PR that touches none of those — like #836 (workflow-only) and #832 (workflows + config + docs) — never gets the check reported, so GitHub shows it as waiting forever and the PR is BLOCKED even with every triggered check green.

Solution

GitHub's documented pattern for required-but-path-filtered checks: a mirror workflow with an identically named job that succeeds instantly, triggered by the exact inverse filter (paths-ignore with the same list the real workflow uses in paths).

• PR touches code paths → real Postgres tests run and report the check.
• PR touches nothing relevant → mirror reports the same check name, green.
• The two lists must stay in sync (noted in a header comment in both file's terms).

Verification

This PR is its own end-to-end test: it's workflow-only, so it deadlocks under the current setup — the mirror workflow it adds is what reports Postgres integration tests on it and flips it mergeable.

Notes

• Once merged, chore(ci): 7-day grace period for newly published HIGH CVEs in Trivy scan #836 and chore(ci): make staging ephemeral — provision per deploy, destroy after #832 need a branch update (I'll push a rebase) so the mirror runs on them and clears BLOCKED.
• Alternative considered: dropping the required check — rejected, it's load-bearing for code PRs.

🤖 Generated with Claude Code