fix(graphile-llm): key agent discovery by database_id, and actually run express-context in CI

[pyramation]

Summary

Finishes the sweep started in #1644. Scanning every template literal in the repo that selects FROM metaschema_*/routing_*/catalog_*/compute_* with a LIMIT 1 and no WHERE leaves zero unkeyed lookups; the one remaining was graphile-llm's agent discovery:

   FROM metaschema_modules_public.agent_chat_module acm
   JOIN metaschema_public.schema s ON s.id = acm.schema_id
+  WHERE acm.database_id = $1
   LIMIT 1

Two things made it worse than the express-context copies:

It was keyed by dbname, not database_id — getAgentDiscovery(pool, dbname) cached under a database name while the query filtered on nothing at all, so in a schema-per-tenant serving database every tenant got whichever tenant's agent tables the planner reached first, memoised for 60s. The parameter is now databaseId (a breaking signature change to a published export, but there are no in-repo callers, and the old contract could not return a correct answer).

Its catch was bare, so the failure mode was invisible:

-  } catch {
-    // Module table doesn't exist in this database — not provisioned
+  } catch (err) {
+    if (!isNotProvisioned(err)) throw err;   // 42P01 | 3F000 only
   }

A dead pool, a permission error or a malformed databaseId all reported "not provisioned", i.e. an API that silently loses its agent surface and answers 200. Now only the absence being probed for is swallowed — this is also what makes the new databaseId contract enforceable, since passing a dbname now raises 22P02 loudly instead of being eaten.

packages/express-context is in no CI batch

Which means the tenant-keying guard test #1644 added — the thing that is supposed to stop this class from coming back — has never run in CI. Added it to the packages-core unit batch (pure unit tests, no services).

Worth a separate issue: 35 packages with tests that no CI job runs

While checking the above I enumerated the workspace against the workflow matrices. Excluding express-context (fixed here), 34 packages / 85 test files are in no batch — including packages/errors, where #1643 just landed registry-sync.test.ts specifically to catch cross-repo drift. It passes locally; CI has never executed it. Full list: agentic/* (12), pgpm/transform (14 files), pgpm/export (9), pgpm/slice (6), graphile/graphile-upload-plugin, graphile-realtime-subscriptions, graphile-sql-expression-validator, postgres/pg-cache, packages/server-utils, packages/node-type-registry, and others. This is the same gap constructive-planning#1410 records for constructive-db. Not fixed here — some of those need services, and a few may be failing today.

graphile-llm: 5 new tests (per-tenant resolution, cache keying, provisioned-vs-fatal error split, empty databaseId), lint and build clean.

Link to Devin session: https://app.devin.ai/sessions/087553534c774929918ec4d378845881
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring