refactor(cli): cover the db-bootstrap, stack and test-db modules with effect lint (CLI-2655)

[7ttp]

TL;DR

brings the db-bootstrap, stack, start and test-db modules under the effect lint, tests included

whats introduced?

• db-bootstrap/**, stack-*, start-* and test-db.* join the allow list,
  with db-bootstrap/local-db-running kept out that for now since it probes the docker engine socket through node:http
• start-secrets-cleanup removes staged secrets through FileSystem, and test-db builds its pg_prove args through Path, instead of node:fs and node:path
• the stack shadow-cache key is encoded through Schema with the same bytes, and yieldable errors are yielded directly instead of through Effect.fail
• the tests swap node: imports and JSON for effect services and schemas, and the start-secrets traversal test now aims at a real canary outside the staging root

ref

• closes: CLI-2655

[github-actions]

🤖 AI Review

Both independent reviews were available: Claude reported four findings and Codex reported none. Three findings are confirmed: ineffective traversal-test coverage, import-time Path provisioning, and test fixtures without guaranteed cleanup. The secret-retention finding remains uncertain because the underlying filesystem implementation was unavailable for inspection. No duplicate findings were present.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/command-internal/start-secrets-cleanup.ts:30	security	claude	A failed removal interrupts sibling cleanup effects, potentially leaving other containers' staged secrets on disk.
🟡 MINOR	apps/cli/src/command-internal/start-secrets-cleanup.unit.test.ts:116	test-coverage	claude	The traversal payload resolves to a different location from the canary, so this test passes even if the containment guard is removed.
⚪ NIT	apps/cli/src/command-internal/test-db.pg-prove-args.ts:6	effect-idioms	claude	Import-time Effect.runSync provisioning hardcodes Path implementations instead of allowing buildPgProveArgs to use the caller's supplied Path service.
⚪ NIT	apps/cli/src/command-internal/db-bootstrap/db-setup.unit.test.ts:160	test-hygiene	claude	Temporary test directories have no guaranteed cleanup when assertions or effects fail, and several migrated tests redundantly provide BunServices.

Stats

Claude findings: 4 · Codex findings: 0 · Confirmed: 3 · Refuted: 0 · Uncertain: 1

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.