fix(db): wrap SET LOCAL hnsw.ef_search in $transaction (Phase 0e)

[webdevcom01-cell]

Same root cause as Phase 0a (PR #97): a SET LOCAL Postgres session variable and the subsequent query were issued as separate Prisma calls. With pool connections, the SET LOCAL can land on one connection and the SELECT on another — the ef_search tuning silently reverts to the server default before the vector search runs.

Phase 0a fixed this for the org-context session variable in withOrgContext. Phase 0e applies the same $transaction wrap to all three SET LOCAL hnsw.ef_search call sites surfaced during STEP 1 audit:

1. src/lib/knowledge/search.ts:201 (searchKnowledgeBase)

   • Hot path: 6+ production callers (KB chat/eval API routes, kb-search-handler runtime, MCP tool exposure, rag-inject, codebase-rag SDLC).
   • Dynamic ef_search (40 | 60 | 100) based on query word count.
   • Vector search on KBChunk.

2. src/lib/memory/hot-cold-tier.ts:113 (getColdMemories)

   • No production callers in src/ today, but exported and reachable dynamically. Patched for consistency with the other two sites so the pattern is uniform across the codebase.
   • ef_search = 40 (hardcoded).
   • Vector search on AgentMemory.

3. src/lib/runtime/handlers/memory-read-handler.ts:168 (memoryReadHandler vector search path)

   • Runtime handler for the memory_read node type. Triggered for every agent run that includes a memory_read node.
   • ef_search = 40 (hardcoded).
   • Vector search on AgentMemory.

PLAN-V2 §4.5 named only search.ts; the audit instruction in that section ('Apply same pattern to other SET LOCAL callers if discovered during STEP 1 audit') is honored here with all three sites in one PR.

FORENSIC HAL-9 covers the same finding.

Tests:

• 63 existing tests still pass (search.test.ts utility tests: 30; hot-cold-tier.test.ts: 16; memory-read-handler.test.ts: 17).
• 6 new regression-guard tests added in two new files: src/lib/knowledge/tests/search-vector-shape.test.ts (3) src/lib/runtime/handlers/tests/memory-read-handler-vector-shape.test.ts (3)
• hot-cold-tier.test.ts mock extended with $transaction delegating to a tx mock; existing assertions on $executeRawUnsafe still hold via tx-aliased fn references.
• Each shape test asserts: (a) $transaction is invoked, (b) SET LOCAL runs on the tx, not the outer prisma, (c) callback receives tx, (d) outer prisma's direct exec/query paths are NOT used.
• Mocked tests verify SHAPE of the fix. They cannot verify pool-survival semantics; that needs a real Postgres integration harness (TODO comments left for Phase 1+).

Risk:

• search.ts is on the KB hot path. $transaction holds a pool connection for the duration of the callback (one SET LOCAL + one SELECT, both microsecond-millisecond). Should not materially affect pool exhaustion under load; verify in staging if concerned.
• hot-cold-tier.ts getColdMemories has no production callers, so functional risk is zero.
• memory-read-handler.ts vector search is per-agent-run when memory_read node fires. Similar transaction profile to search.ts.

Out of scope (intentional):

• Migrating $executeRawUnsafe -> $executeRaw on hot-cold-tier.ts and memory-read-handler.ts. Both keep the existing Unsafe variant; SET LOCAL takes no parameters, no SQL injection vector. Refactoring to safer APIs is a separate workstream.

Verification:

• vitest run (search.test.ts + search-vector-shape.test.ts + hot-cold-tier.test.ts + memory-read-handler.test.ts + memory-read-handler-vector-shape.test.ts): 69 passed
• tsc --noEmit -p tsconfig.json: exit 0

Refs:

• skill-rls-rollout-PLAN-V2.md §4.5 (Phase 0e bundled bug fix)
• skill-rls-rollout-FORENSIC-REPORT.md HAL-9
• PR fix(db): wrap withOrgContext in $transaction so session var survives … #97 (Phase 0a — same fix pattern for withOrgContext)
• PR docs(rls): track 3 deferred items from Phase 0a rollout #98 (docs/rls-tech-debt.md — tracking)

Description

Briefly describe the changes in this PR and the motivation behind them.

Type of change

• New feature
• Bug fix
• Documentation update
• Refactor (no behavior change)
• Test update
• Chore (build, CI, dependencies)

Checklist

• I have read the Contributing Guide
• My code follows the project code standards (TypeScript strict, no any, Tailwind only)
• I have added tests that cover my changes
• All tests pass (pnpm test)
• Linting passes (pnpm lint)
• Type checking passes (pnpm typecheck)
• I have updated documentation if needed
• No console.log statements left in code
• No hardcoded secrets or internal URLs