feat(gate): block PRs with schema changes (gate the API's signal)

[veksen]

Goal

External dogfooding feedback (Query-Doctor/Site#3289): a migration should force a human eyeball before merge. This adds the gate — the only missing piece. The analyzer already gets the real schema diff from the API (runMetadata.schemaChange) and renders it in the comment; nothing acted on it. Now a schema change blocks the check by default. Addresses Query-Doctor/Site#3289.

What

Before → after for a PR that changes the schema:

• Before: the comment showed "N schema changes vs main", the check stayed green. A migration with no query regression sailed through.
• After: the check fails by default with "validate the migration before merge". A repo softens it to warn (shown, non-blocking) or off via the schema-drift policy, which already exists in the condition catalog.

How

• src/gate/schema-change.ts (new) — gateSchemaChange(schemaChange, policy) takes the API's existing runMetadata.schemaChange and routes { condition: "schema-drift", verdictClass: "finding" } through the shared resolveVerdict (taxonomy #3498 + policy #3500). Returns failure (block), neutral (soften), or null (no change / off). No detection — the API owns that.
• src/main.ts — reads reportContext.runMetadata?.schemaChange, calls the gate, then core.setFailed / core.warning, alongside the test-presence gate.

Tests

src/gate/schema-change.test.ts — blocks by default, softens under warn, drops under off, passes when the run has no change or the API sent no signal.

Full suite green except one pre-existing site-api.test.ts failure (a local core-version skew, present on main without this change).

[github-actions]

Query Doctor Analysis

3 queries analyzed

0 regressed · 0 improved · 0 new · 0 removed

2 pre-existing issues

• SELECT "guests"."id", "guests"."session_id", "guests"."username", "guests"."avatar_path", "guests"."color", "guests"."side", "guests"."audio_recording_path", "guests"."audio_recording_public", "gue...
  index assets(event_id, inserted_at desc)
  cost 31,003,449 → 1,498 (100% reduction)
• SELECT * FROM guest_ip_addresses WHERE ip_address = '127.0.0.1';
  index guest_ip_addresses(ip_address)
  cost 154,402 → 8 (100% reduction)

_{Using assumed statistics (10000000 rows/table). For better results, sync production stats.}

_{More detail → get_ci_run({ runId: "019f8f6b-6523-7348-b789-375ea1764520" }) · view run · docs}