feat: upstream constructive-db pgpm-modules (db-utils, infra-utils, jobs/errors, function-resolution)

[pyramation]

Summary

Syncs packages/* with constructive-db main pgpm-modules/* (source of truth). Most module diffs were boilerplate only (default_version, test import constructive-test vs pgsql-test, LICENSE/Makefile). Upstream conventions are kept for those; only substantive content is ported.

New packages

• @pgpm/db-utils: db_utils.jsonb_deep_merge, jsonb_set_deep, get_column_smart_comment, timestamps
• @pgpm/infra-utils: infra_utils.param_quantity, resource_params, resource_installation_guards, resource_admission; requires db-utils and errors
• Both are at 0.46.1 with workspace:* deps and a pgsql-test test harness, added to the CI matrix and MODULES.md. pnpm-workspace.yaml, pgpm.json, and lerna already pick them up via packages/*.

jobs / database-jobs: run_scheduled_job handles transport-suppressed enqueues. It tracks prev_scheduled_id, and when the insert returns no row it falls back to last_scheduled_id, otherwise raising errors.raise_error('SCHEDULED_JOB_NOT_ENQUEUED', …). The new direct dependency is declared at every level:

-- requires: errors:schemas/errors/procedures/raise_error      (deploy header)
requires = '…,errors'                                            (.control)
run_scheduled_job [… errors:schemas/errors/procedures/raise_error] (pgpm.plan)
"@pgpm/errors": "workspace:*"                                    (package.json)

It also adds the run-scheduled-job-suppressed-transport tests.

function-resolution: resolve now reads from function_resolution.frame_candidates(database_id, scope, entity_id) instead of expanding app_scope.frames inline. frame_candidates is now registered in pgpm.plan, and resolve depends on it. Adds hosted/shared-surface coverage to capabilities.test.ts.

Docs: README text ported for app-scope, errors, jobs, jwt-claims, metaschema-modules, and function-resolution.

Lockfile/policy: metaschema-modules drops the unused constructive-test devDep. The lockfile was updated with pnpm 10 and is prettier-formatted to match. pnpm-workspace.yaml was regenerated with pnpm-policy generate, which removes the constructive-test exemption.

Bundles in sql/ were regenerated with pgpm package, not hand-edited. Versions are not bumped here; that happens with lerna version at release time, per PUBLISH.md.

Local verification against PG18 (postgres-plus:18):

• pnpm test passes in all 30 packages. errors, ltree-helpers, and uuid have no tests.
• pgpm test-packages --full-cycle passes (16/16 leaf modules).
• pnpm run policy:check passes.
• git diff --check is clean.

Link to Devin session: https://app.devin.ai/sessions/2aa2dd55edd7480db840cab8a8428607
Open in Devin Desktop: https://app.devin.ai/desktop/session/2aa2dd55edd7480db840cab8a8428607?variant=devin
Requested by: @pyramation

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. 🟠 4 high · 🟡 1 medium

💬 Inline comments (5)

• 🟠 Declare the missing stamps dependency of timestamps — timestamps.sql:20
• 🟠 Fix jsonb_set_deep array slice subscript bug — jsonb_set_deep.sql:36
• 🟠 Reject empty annotation prefix in allow-list rules — resource_admission.sql:287
• 🟠 Fail closed on malformed min/max bounds — resource_params.sql:366
• 🟡 Detect conflicting shared-parameter metadata in bundles — resource_params.sql:685

---

The PR introduces two new pgpm packages and updates the job scheduler. db-utils ships recursive jsonb_deep_merge/jsonb_set_deep procedures, a SECURITY DEFINER smart-comment helper, and a timestamps() trigger factory; infra-utils adds a typed parameter compiler (resource_params, param_quantity), installation guards, and a fail-closed admission gate for resource specs. The run_scheduled_job procedure in both jobs and database-jobs now suppresses ticks when the transport already recorded the schedule, with matching tests. Generated bundles, plans, control files, and CI/pnpm-workspace wiring were regenerated to match. Several high-severity issues remain in the new SQL: a missing stamps extension dependency, an array-slice subscript bug in jsonb_set_deep, an empty annotation prefix that weakens the admission allow-list, and malformed min/max parameter bounds that are silently ignored rather than rejected.

Files	Change
packages/db-utils/**	New extension: jsonb deep-merge/set helpers, smart comments, timestamps trigger, with deploy/revert/verify, plan, control, bundle, and tests.
packages/infra-utils/**	New extension: parameter-interface compiler, quantity parsing, installation guards, and fail-closed Kubernetes resource admission, with tests.
packages/jobs, packages/database-jobs	run_scheduled_job suppressed-transport fix in deploy SQL and regenerated bundles, plus new tests.
packages/function-resolution	Shared frame_candidates wrapper refactor of resolve.sql and bundle regeneration.
CI / workspace	ci.yml, pnpm-workspace.yaml, and package manifests updated for the new packages and versions.

_{Reviewed commit: f10acc5}

[tenki-reviewer]

This PR adds a new db-utils extension (recursive jsonb merge/set helpers, smart column comments, trigger-based timestamps), a new infra-utils extension (typed parameter-interface compiler and a fail-closed Kubernetes resource admission gate), and fixes run_scheduled_job suppressed-transport behavior across the jobs and database-jobs packages.

Key findings

• 🟠 Declare the missing stamps dependency of timestamps — timestamps.sql:20
• 🟠 Fix jsonb_set_deep array slice subscript bug — jsonb_set_deep.sql:36
• 🟠 Reject empty annotation prefix in allow-list rules — resource_admission.sql:287
• 🟠 Fail closed on malformed min/max bounds — resource_params.sql:366
• 🟡 Detect conflicting shared-parameter metadata in bundles — resource_params.sql:685