fix(ci): connect integration tests via service network alias

act_runner runs ubuntu-latest jobs in their own container, so
localhost from inside the job never reaches the postgres service's
published host port (confirmed on a fresh CI run: dynamic port
32768 was assigned with no bind collision, but the connection was
still refused). Drop the host port publish and job.services context
lookup, and connect via the service alias/container port
(postgres:5432) instead, which is reachable on the shared job
network.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/integration.yml

@@ -19,12 +19,6 @@ jobs:
           POSTGRES_DB: broker_test
           POSTGRES_USER: user
           POSTGRES_PASSWORD: password
-        ports:
-          # No fixed host port: Docker assigns a free one, avoiding
-          # "port is already allocated" collisions with other jobs on a
-          # shared runner. The assigned port is read below via the
-          # `job.services.postgres.ports` context.
-          - 5432/tcp
         options: >-
           --health-cmd="pg_isready -U user"
           --health-interval=5s
@@ -43,6 +37,12 @@ jobs:
 
       - name: Run all tests
         env:
-          TEST_DB_HOST: 127.0.0.1
+          # act_runner runs this job in its own container alongside the
-          TEST_DB_PORT: ${{ job.services.postgres.ports['5432'] }}
+          # postgres service container, both on the job's Docker network.
+          # "localhost" from inside the job container is the job container
+          # itself, not the runner host, so the service must be reached by
+          # its network alias (the services: key) and container-internal
+          # port -- not a published host port.
+          TEST_DB_HOST: postgres
+          TEST_DB_PORT: 5432
         run: make test-ci TEST_DB_HOST="$TEST_DB_HOST" TEST_DB_PORT="$TEST_DB_PORT"