fix(ci): use service DNS for hub-check Postgres (no host port)

Concurrent hub-check jobs raced on host-published 5432/15432. Drop the
host port mapping and talk to the service container as postgres:5432.

.gitea/workflows/hub-check.yml

@@ -20,9 +20,9 @@ jobs:
           POSTGRES_USER: paradigm
           POSTGRES_PASSWORD: paradigm
           POSTGRES_DB: cph_hub_test
-        # Avoid host-port binds: concurrent hub-check jobs on the same runner
-        # raced on 5432/15432 ("port is already allocated"). Reach the service
-        # by Docker DNS name from the job container instead.
+        # Avoid host-port binds: concurrent hub-check jobs on the shared
+        # runner raced on published 5432/15432 ("port is already allocated").
+        # Reach the service by Docker DNS name from the job container instead.
         options: >-
           --health-cmd "pg_isready -U paradigm -d cph_hub_test"
           --health-interval 5s
@@ -49,6 +49,7 @@ jobs:
 
       - name: Install Linux sandbox dependency
         run: sudo apt-get update && sudo apt-get install --yes bubblewrap socat
+
       - name: Wait for Postgres
         run: |
           node <<'NODE'
@@ -104,15 +105,15 @@ jobs:
         run: npx vitest run test/unit
 
       # Integration tests need PostgreSQL + cph. cph is installed above.
-      # PostgreSQL is set up as a service container below.
+      # PostgreSQL is the job service container reachable as `postgres`.
       - name: Run integration tests (mock provider, real prisma + cph)
         run: |
           npx prisma migrate deploy --schema prisma/schema.prisma
           npx vitest run test/integration \
             --exclude test/integration/real-model.test.ts \
-          DATABASE_URL: postgresql://paradigm:paradigm@postgres:5432/cph_hub_test
+            --exclude test/integration/agent-sandbox-linux.test.ts
         env:
-          DATABASE_URL: postgresql://paradigm:paradigm@127.0.0.1:15432/cph_hub_test
+          DATABASE_URL: postgresql://paradigm:paradigm@postgres:5432/cph_hub_test
 
       # Real-model tests are opt-in: set RUN_REAL_MODEL_TESTS=true and provide
       # OPENROUTER_API_KEY when a branch should hit live OpenRouter.