fix(database): preserve ACL proof credentials (OMN-15355)

[jonahgabriel]

Summary

• Preserves the configured PostgreSQL admin authentication and connection options when the ACL proof retargets its scaffold database.
• Adds a regression test for the credential-preserving DSN transformation.
• Isolates config-prefetch health tests from the host ~/.omnibase/.env, preventing order-dependent leakage into verification CLI tests.

Stack

Stacked-Parent: #2548

• Base: feat(runtime): type database ownership wiring (OMN-15418) #2548 / jonah/omn-15418-p0-replace-raw-db_io-loading-with-typed-declarations-and
• Follow-up to: feat(database): generate application ACL matrix (OMN-15355) #2568 / OMN-15355

Failure and evidence

• Rebuilt PostgreSQL 16 runs 30562145775 and 30564691232 failed deterministically with fe_sendauth: no password supplied after the scaffold DSN discarded the configured password.
• Focused DSN, health-prefetch, and verification CLI suite: 27 passed.
• The original order-dependent reproducer is green: 26 passed.
• Ruff format/lint and commit hooks pass.
• Independent review: PASS with PostgreSQL psql 16.14 conninfo compatibility verified, including quoted credentials and connection options.
• Hosted rebuilt PostgreSQL 16 proof: run 30566136064 PASS on exact head a59d5c3f (21 objects, 200 ACL rows, 96 default rows), including scaffold apply twice, full apply twice, rollback, and reapply twice.
• Exact .200 pre-push gate: strict mypy PASS, architecture PASS, governed full unit suite 22,583 passed, 40 skipped. The first attempt had one unrelated lifecycle timing failure after 22,582 passes; the exact test, its 75-test file, and all 1,853 service tests passed, then the unchanged full rerun passed.

Safety

• Synthetic proof and test isolation only.
• No live database query or mutation, grant/revoke, RLS change, deploy, restart, cutover, or destructive action.

Ticket: OMN-15355

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 31cb5e1e-6a25-40ff-9191-c6a271c1eee8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}