fix(ci): 使用隔离服务运行 PostgreSQL 集成库

将 PostgreSQL 16 改为固定 digest 的 Actions service container，并通过专用 Job 网络向 Go migrator 和集成测试提供数据库。

移除 PR Job 对 Docker CLI 的依赖，继续禁止宿主及内层 Docker API 暴露；同步发布工作流、契约测试和镜像代理恢复说明。

scripts/provision-ci-runner.sh

@@ -26,8 +26,6 @@ SHELLCHECK_VERSION=0.11.0
 SHELLCHECK_SHA256=8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
 COMPOSE_VERSION=5.3.1
 COMPOSE_SHA256=f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959
-DOCKER_CLI_VERSION=29.6.0
-DOCKER_CLI_SHA256=80b40fa11d797a71ea15f9a31e7004790ddac95f58a8222a40c08f08a639faba
 PNPM_VERSION=10.18.1
 RUNNER_IMAGE='docker.io/gitea/runner:2.0.0-dind-rootless@sha256:5b7b625ff773d0ee761788c47582503ec1b241fa5b81edebad48a57e663f4f3a'
 JOB_IMAGE='docker.io/library/node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7'
@@ -192,22 +190,10 @@ GOBIN="$PREFIX/bin" GOPROXY="${GO_MODULE_PROXY:-https://goproxy.cn,direct}" \
   "$PREFIX/toolchains/go/bin/go" install golang.org/x/vuln/cmd/govulncheck@v1.6.0
 
 require_free_space "$MIN_FREE_GIB" "runner image pull"
-if ! docker image inspect "$RUNNER_IMAGE_SOURCE" >/dev/null 2>&1; then
-  docker pull "$RUNNER_IMAGE_SOURCE"
-fi
+docker pull "$RUNNER_IMAGE_SOURCE"
 runner_runtime_image=$(docker image inspect --format '{{.Id}}' "$RUNNER_IMAGE_SOURCE")
 printf '%s\n' "$runner_runtime_image" | grep -Eq '^sha256:[0-9a-f]{64}$' || \
   fail "pinned runner image did not resolve to an immutable local image ID"
-
-# The job image intentionally contains no Docker client. Extract the static CLI
-# from the immutable Runner image, then verify its binary digest before exposing
-# it through the read-only CI toolchain mount.
-docker_cli_download="$PREFIX/downloads/docker-${DOCKER_CLI_VERSION}-linux-x86_64"
-docker run --rm --pull=never --entrypoint /bin/cat "$runner_runtime_image" \
-  /usr/local/bin/docker > "$docker_cli_download"
-printf '%s  %s\n' "$DOCKER_CLI_SHA256" "$docker_cli_download" | sha256sum -c -
-install -m 0755 "$docker_cli_download" "$PREFIX/bin/docker"
-"$PREFIX/bin/docker" --version | grep -Fq "Docker version ${DOCKER_CLI_VERSION},"
 chown -R root:root "$PREFIX"
 chmod -R go-w "$PREFIX"
 
@@ -313,7 +299,6 @@ docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
     go version
     node --version
     pnpm --version
-    docker --version
     docker-compose version
     shellcheck --version
     trivy --version