Add Postgres remote query proof executor

[nubtron]

Summary

Adds a proof-of-concept Postgres remote query executor for the remote queries research path.

This POC includes:

• an explicit check registry abstraction
• exact {host, port, dbname} check matching
• fail-closed target selection behavior
• credential-shaped field rejection in request payloads
• a strict proof-query policy limited to SELECT 1 AS value
• execution through the matched check's existing db_pool.get_connection(target.dbname) path
• unit tests and a targeted Docker-backed integration test

Scope / caveats

This is intentionally a proof executor, not a production remote-query implementation. It does not prove that PAR-in-Agent can enumerate or access live PostgreSql check instances; it only proves the Agent-local Python execution seam once an explicit registry supplies the matching check.

Verification

From ddev/ in this worktree:

hatch run -- ddev test -fs postgres
hatch run -- ddev test postgres:py3.13-9.6-UTF8 -- tests/test_remote_query.py -k "remote_query and not integration"
hatch run -- ddev test postgres:py3.13-9.6-UTF8 -- tests/test_remote_query_integration.py -k "agent_local_executor_select_1" -s

Recorded results:

• format/lint: passed
• unit tests: 23 passed
• targeted integration test: 1 passed

[datadog-prod-us1-6]

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 90.33%
• Overall Coverage: 92.68% (+5.53%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 92ac25c | Docs | Datadog PR Page | Give us feedback!}

[codecov]

Codecov Report

❌ Patch coverage is 90.33333% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.35%. Comparing base (18c80aa) to head (92ac25c).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dd-octo-sts]

Validation Report

All 20 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and Codecov settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run