chore(ci): add workspace and db guardrails

scripts/prisma-with-env.mjs

@@ -2,9 +2,12 @@
 
 import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
-import { loadWorkspaceEnv } from "./load-env.mjs";
+import { getExpectedDatabaseName, inspectDatabaseUrl, shouldGuardPrismaCommand } from "./db-target-guard.mjs";
+import { loadWorkspaceEnv, resolveRealWorkspaceRoot } from "./load-env.mjs";
 
 loadWorkspaceEnv();
+const workspaceRoot = resolveRealWorkspaceRoot();
+process.chdir(workspaceRoot);
 
 const args = process.argv.slice(2);
 
@@ -18,9 +21,21 @@ const prismaArgs = hasSchemaArg
   ? args
   : [...args, "--schema", resolve("packages/db/prisma/schema.prisma")];
 
+if (shouldGuardPrismaCommand(prismaArgs)) {
+  try {
+    inspectDatabaseUrl(process.env.DATABASE_URL, getExpectedDatabaseName());
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    console.error("Refusing to run Prisma against an unexpected database target.");
+    console.error("Use the repo env files for CapaKraken, or set CAPAKRAKEN_EXPECTED_DB_NAME explicitly if you intentionally target another database.");
+    process.exit(1);
+  }
+}
+
 const result = spawnSync("pnpm", ["--filter", "@capakraken/db", "exec", "prisma", ...prismaArgs], {
   stdio: "inherit",
   env: process.env,
+  cwd: workspaceRoot,
 });
 
 if (result.error) {