chore(infra): per-PR schema sweep owner and CI wiring for preview environments

Start by reading the cited ownership questions Q-0094.7 and Q-0094.1, then inspect the infrastructure scripts products/thrust/kube/scripts/pr-schema.sh and hyperdrive.sh and this repository’s .github/workflows/ files. The issue asks for an owner decision, scheduled reconciliation, preview CI, bounds, and live validation; done means the acceptance criteria pass, including hermetic sweep tests and cleanup checks.

Context

PR previews are meant to run on the shared dev database with one schema per PR (ADR-0092 line 76; Q-0092.2, QUESTIONS.md:227), on thrust-pg-dev, the one-instance cluster that hosts dev, staging and the per-PR schemas (ADR-0094 line 70). The infrastructure repository has products/thrust/kube/scripts/pr-schema.sh create|drop|list <n>: login role pr_<n> with a connection limit of 8, schema pr_<n> owned by it, and a role-level search_path, run with psql through kubectl exec on the dev primary (research/0010 lines 107-110). hyperdrive.sh ensure creates a per-PR Hyperdrive config with caching disabled (ADR-0094 line 95). Spike 0001 Stage 2 used both live: create, migrate as the role, the Worker found its tables with no application search_path, then drop with a clean catalog (ADR-0094 line 131; research/0004 §10.1 line 351 and §10.7 line 451). This repository's CI has no preview job (.github/workflows/: ci.yml, contract-cell.yml, flake-hunt.yml).

Problem

Nothing is automated (research/0010 lines 110-112): no wiring to PR events, no sweep of schemas left by PRs that closed without the hook, nobody calls hyperdrive.sh ensure, and there are no per-PR migrations or storage bounds. Q-0094.7 (QUESTIONS.md:339) and Q-0094.1 (QUESTIONS.md:300: "the per-PR schemas and CI wiring are still unowned") are open, and so is the owner question in research/0010 §9 item 7 (line 261). Round 25 flagged the missing cleanup, ownership and migration-lock story (REVIEW-NOTES.md:151), and spike 0002 step 9 asks for it (spikes/0002-database-engine.md:28). Review §4 lists the cleanup owner as unassigned. Every leaked schema keeps a login role with 8 connections on a one-instance cluster.

Proposal

• Owner decision first: who owns the sweep and where it runs. Default: the infrastructure repository, which already holds pr-schema.sh, hyperdrive.sh and the cluster credentials.
• Reconcile instead of relying on hooks: a scheduled job lists the open PRs of aRustyDev/thrust that want a preview (gh pr list --state open), lists pr-schema.sh list and the per-PR Hyperdrive configs, creates what is missing and drops what has no open PR. A missed close event then costs one period, not a leak.
• Preview deploy in this repository's CI: on PR open or push, wait for the schema and the config, run the expand migrations as role pr_<n> (each PR owns its schema, so previews need no shared migration lock), and deploy a preview Worker bound to that config, using the same expand step as the deploy pipeline (#49).
• Bounds: at most N live previews, and a schema with no push for M days is dropped.
• The status.woven probe in Q-0094.7 is #42. If #37 picks the Durable Object engine, the per-PR Postgres schema goes away and the loop manages preview Workers only.

Acceptance criteria

• Q-0094.7's per-PR item is answered with the owner and the job's home, citing FR-10.
• The reconcile script has hermetic tests with fake gh, kubectl and curl, in the style of test-pr-schema.sh (research/0010 line 131). Control: a sweep that ignores the open-PR list (and so drops an open PR's schema) fails them.
• Live: a test PR's pr_<n> schema and Hyperdrive config appear within one period of opening; within one period of closing, pr-schema.sh list no longer shows it and the catalog check from research/0004 §10.7 (0 roles, 0 schemas, 0 pr_% role settings) passes.
• The preview migration step runs as pr_<n>; a migration that writes to public fails with a permission error (control).

References

• Review: .agents/plans/contrail/reviews/2026-10-19-fable-architecture-review.md (FR-10, §4 "Per-PR schemas")
• Q-0094.7, Q-0094.1, Q-0092.2; ADR-0094 (lines 70, 95, 131), ADR-0092 (line 76)
• research/0010-thrust-postgres-infra-plan.md lines 107-112, 131, 261
• research/0004-rust-on-workers-binding-matrix.md §10.1 (line 351), §10.7 (line 451)
• REVIEW-NOTES.md:151; spikes/0002-database-engine.md:28
• Infra repository: products/thrust/kube/scripts/pr-schema.sh, hyperdrive.sh
• Beads: plane-byd.4

Finding: FR-10 (Q-0094.7)