ci: use prisma db execute (no psql dep); baseline migrations after push

- e2e: switch schema reset + sanity check from psql (not installed in
  act_runner's catthehacker/ubuntu image) to `prisma db execute --stdin`
  which is already a dev dep.
- docker-deploy: after `db push` the schema matches schema.prisma but
  _prisma_migrations is empty, so the follow-up `migrate deploy` fails
  with P3005. Baseline each migration directory as applied via
  `prisma migrate resolve --applied` before deploy; the migrations
  themselves are idempotent supplements, so marking-as-applied is safe.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -351,20 +351,21 @@ jobs:
         run: pnpm --filter @capakraken/web exec playwright install-deps chromium
 
       - name: Push DB schema & seed
-        env:
-          PGPASSWORD: capakraken_test
         run: |
           # Nuke any leftover schema state from a previous job that shared the
           # postgres service container (act_runner reuses service volumes).
-          # --force-reset alone proved unreliable here: push reported "in sync"
-          # but audit_logs ended up missing, suggesting a split-brain between
-          # the reset and the subsequent DDL.
-          psql -h postgres -U capakraken -d capakraken_test -v ON_ERROR_STOP=1 \
-            -c "DROP SCHEMA IF EXISTS public CASCADE; CREATE SCHEMA public; GRANT ALL ON SCHEMA public TO capakraken; GRANT ALL ON SCHEMA public TO public;"
+          # --force-reset alone proved unreliable: push reported "in sync" but
+          # audit_logs ended up missing. Use prisma db execute (no psql dep).
+          printf '%s\n' \
+            'DROP SCHEMA IF EXISTS public CASCADE;' \
+            'CREATE SCHEMA public;' \
+            'GRANT ALL ON SCHEMA public TO capakraken;' \
+            'GRANT ALL ON SCHEMA public TO public;' \
+            | pnpm --filter @capakraken/db exec prisma db execute --stdin --schema ./prisma/schema.prisma
           pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --accept-data-loss --skip-generate
           # Sanity check: confirm the schema actually landed before seeding.
-          psql -h postgres -U capakraken -d capakraken_test -v ON_ERROR_STOP=1 \
-            -c "SELECT to_regclass('public.audit_logs') AS audit_logs, to_regclass('public.users') AS users;"
+          printf "SELECT to_regclass('public.audit_logs'), to_regclass('public.users');\n" \
+            | pnpm --filter @capakraken/db exec prisma db execute --stdin --schema ./prisma/schema.prisma
           pnpm db:seed
 
       - name: Run E2E tests

tooling/docker/app-dev-start.sh

@@ -28,6 +28,17 @@ pnpm --filter @capakraken/db db:generate
 # migration references "users" before it exists.
 pnpm --filter @capakraken/db exec prisma db push --schema ./prisma/schema.prisma --accept-data-loss --skip-generate
 
+# After db push the schema matches schema.prisma exactly, but the
+# _prisma_migrations table is empty, which makes `migrate deploy` fail
+# with P3005 ("schema is not empty"). Baseline each migration as applied
+# so deploy sees a clean slate; the migrations themselves are idempotent
+# supplements (IF NOT EXISTS guards), so marking-as-applied is safe.
+for m in packages/db/prisma/migrations/*/; do
+  name=$(basename "$m")
+  pnpm --filter @capakraken/db exec prisma migrate resolve \
+    --applied "$name" --schema ./prisma/schema.prisma || true
+done
+
 # Run pending migrations so a fresh checkout picks up incremental additions
 pnpm --filter @capakraken/db db:migrate:deploy