test: close the DB-suite hermeticity + vacuous-skip gaps

Three related fixes from the test audit.

**The CLI journey fixture gets its own database.** It spawned a real picloud —
whose dispatcher/orchestrator claim loops are global by design (one instance owns
one database) — against the shared dev DB, so it could claim the manager-core
suites' outbox/workflow rows (the same class of bug already fixed for the e2e
suites, one binary over). It now clones one dedicated database per journey run
from the migrated template. test-support gains `named_test_db_url` (explicit
stable name) + a blocking wrapper for the sync `LazyLock` fixture. The one journey
that talks to Postgres directly (dead-letter injection) now uses the fixture's DB
URL, not the base DATABASE_URL, so it hits the database the server reads.

**workflow_orchestrator moves to per-test databases.** Its `claim_ready_step` is
global, so the old harness serialized every test behind a process-wide CLAIM_LOCK
AND ran `DELETE FROM workflow_runs` (unscoped — it wiped every app's runs) before
each one. A private database per test makes the global claim see only that test's
rows, so both the lock and the unscoped DELETE are deleted.

**DB-backed suites fail loud instead of skipping green.** ~15 manager-core suites
`return None` when DATABASE_URL is unset and report PASS — so in any environment
that lost its database the entire integration surface reports green while running
nothing (why the CI gap went unnoticed for so long). New
`picloud_test_support::abort_if_db_required` panics when `PICLOUD_REQUIRE_DB` is
set (CI now sets it) but DATABASE_URL is not, injected into each suite's skip
path. Local runs without the var still skip cleanly.

Mutation-verified: with PICLOUD_REQUIRE_DB=1 and DATABASE_URL unset, a suite
panics; without the var it skips.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/picloud-cli/tests/common/mod.rs

@@ -29,6 +29,11 @@ pub struct Fixture {
     pub url: String,
     pub admin_token: String,
     pub admin_username: String,
+    /// The Postgres URL the spawned picloud is using — a per-journey-run cloned
+    /// database, NOT the base `DATABASE_URL`. A test that talks to the DB directly
+    /// (e.g. injecting a dead-letter row) must use THIS so it hits the same
+    /// database the server does.
+    pub database_url: String,
     // Held in a Mutex so Drop can kill it without UB; we never re-enter.
     child: Mutex<Option<Child>>,
 }
@@ -46,8 +51,13 @@ impl Drop for Fixture {
 static FIXTURE: LazyLock<Fixture> = LazyLock::new(init_fixture);
 
 fn init_fixture() -> Fixture {
-    let database_url =
-        std::env::var("DATABASE_URL").expect("DATABASE_URL is required to spawn picloud");
+    // ONE database for the whole journey binary, cloned fresh from the migrated
+    // template. The spawned picloud runs the real dispatcher/orchestrator, whose
+    // claim loops are global by design (one instance owns one database) — sharing
+    // the dev DB with the manager-core suites let it claim their outbox/workflow
+    // rows. A dedicated DB matches production and ends that interference.
+    let database_url = picloud_test_support::named_test_db_url_blocking("pt_cli_journeys")
+        .expect("DATABASE_URL is required to spawn picloud");
     let username = admin_username();
     let password = admin_password();
     let port = server::pick_free_port();
@@ -62,6 +72,7 @@ fn init_fixture() -> Fixture {
         url,
         admin_token: token,
         admin_username: username,
+        database_url,
         child: Mutex::new(Some(child)),
     }
 }
@@ -72,6 +83,13 @@ fn init_fixture() -> Fixture {
 /// no-op outside the integration environment.
 pub fn fixture_or_skip() -> Option<&'static Fixture> {
     if std::env::var("DATABASE_URL").is_err() {
+        // CI sets PICLOUD_REQUIRE_DB so a lost/misconfigured database fails the
+        // build instead of silently skipping the entire journey suite.
+        assert!(
+            std::env::var("PICLOUD_REQUIRE_DB").is_err(),
+            "DATABASE_URL is unset but PICLOUD_REQUIRE_DB is set — refusing to skip \
+             the CLI journeys silently"
+        );
         eprintln!("skipping: DATABASE_URL not set");
         return None;
     }

crates/picloud-cli/tests/dead_letters.rs

@@ -103,9 +103,10 @@ fn replay_against_real_dl_row_succeeds() {
     // minutes to drive. The replay path doesn't care how the row got
     // there, only that it exists, belongs to this app, and is
     // unresolved.
-    let db_url =
-        std::env::var("DATABASE_URL").expect("DATABASE_URL required for replay happy-path test");
-    let mut pg = PgClient::connect(&db_url, NoTls).expect("postgres connect");
+    // Inject into the SAME database the spawned picloud is using — the fixture's
+    // per-journey-run cloned DB, not the base DATABASE_URL. Using DATABASE_URL
+    // here would write the row into a different database than the server reads.
+    let mut pg = PgClient::connect(&fx.database_url, NoTls).expect("postgres connect");
     let dl_id = Uuid::new_v4();
     let app_uuid = Uuid::parse_str(&app_id).expect("app uuid");
     let script_uuid = Uuid::parse_str(&script_id_str).expect("script uuid");