db2: add db2i:// scheme for DB2 for i (IBM i / AS-400)

[cvkramer]

Linear: CE-1025

Add db2i:// scheme for DB2 for i (IBM i / AS-400)

Summary

The existing db2:// engine is built for DB2 LUW: convertToDB2DSN hardcodes the LUW
port (50000) and always appends PROTOCOL=TCPIP. That makes DB2 for i (IBM i / AS-400)
reachable only through the native-DSN passthrough (HOSTNAME=…;PORT=446;…), which is awkward
to express in connector configs.

This PR adds a first-class db2i:// scheme for DB2 for i. It reuses the exact same engine,
driver (go_ibm_db + clidriver), and dialect layer — the only differences are:

• Default port 446 (DB2 for i DRDA) instead of 50000 when the scheme is db2i://.
• PROTOCOL is overridable via a ?PROTOCOL= query parameter (still defaults to TCPIP
  when unset), by removing PROTOCOL from the reserved-keyword set.

db2:// (LUW) behavior is unchanged.

Motivation

Governing IBM i / AS-400 identity via baton-sql over DB2 for i (querying the QSYS2.*
IBM i Services). The dialect layer already handles DB2 for i (bind ?, " quoting,
author-written FETCH FIRST paging); the LUW port/PROTOCOL defaults were the only blockers to
a clean URL-form DSN.

Changes

• pkg/database/db2/dsn.go
  • Accept db2i:// in addition to db2:// (native-DSN passthrough and scheme validation).
  • Default port by scheme: db2 → 50000, db2i → 446.
  • Remove PROTOCOL from reservedDSNKeywords; inject the TCPIP default only when the
    caller didn't supply a ?PROTOCOL=.
• pkg/database/database.go
  • Route case "db2", "db2i": to the DB2 engine.
• pkg/database/db2/dsn_test.go
  • Updated the wrong-scheme assertion; added cases for db2i default-446, explicit port, and
    PROTOCOL override.
• docs/db2.md
  • Documented the db2i:// scheme (default port 446 vs 50000) in the DSN Format section, and
    updated the reserved-keyword note now that PROTOCOL is overridable via ?PROTOCOL=.

Backward compatibility

Fully backward compatible. db2:// DSNs produce byte-identical output; existing tests pass
unchanged except the wrong-scheme error string (updated in this PR).

Testing

• Unit: go test ./pkg/database/db2/ passes, including the new db2i / PROTOCOL cases.
• Live end-to-end: built the db2-tagged binary (make build-db2) and ran it against a DB2
  instance with stub QSYS2 views (mirroring IBM i 7.5 USER_INFO_BASIC,
  GROUP_PROFILE_ENTRIES, AUTHORIZATION_LIST_USER_INFO, etc.). Two configs — accounts-only
  and full (users + groups + special authorities + authorization lists) — synced cleanly:
  19 resources, 20 grants, all correct, including the space-delimited SPECIAL_AUTHORITIES
  column exploded into per-authority grants via VALUES + padded LIKE.

Notes / out of scope

• DB2 Connect licensing: connecting the clidriver to a real DB2 for i over DRDA requires a
  customer-supplied DB2 Connect license (db2consv_is.lic) — see docs/db2.md. That's a
  deployment prerequisite, not addressed by this PR.
• DB2-Connect-free path: an IBM i Access ODBC connection engine (no DB2 Connect, uses the
  5770-XW1 license IBM i shops already hold) would be a separate, larger change — not in scope.
• Separate finding (not in this PR): a User-trait status CEL mapping did not serialize
  onto the emitted resource status in local testing (resource status stayed null while the
  trait carried the SDK default). Worth a follow-up look, unrelated to the DSN change.

[github-actions]

Connector PR Review: db2: add db2i:// scheme for DB2 for i (IBM i / AS-400)

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base f45ad4c.
Review mode: incremental since aa4881b
View review run

Review Summary
The full PR diff was scanned for security and correctness. The new commit updates docs/db2.md to document the db2i:// scheme (default port 446) and the now-overridable PROTOCOL keyword, which addresses the two prior stale-docs findings. The PROTOCOL override path reuses the existing keyword-name validation (special-character rejection and reserved-keyword check) and value quoting, the seen map rejects a duplicate PROTOCOL param, and db2:// DSNs with no PROTOCOL query param remain byte-identical, so db2 LUW behavior is unchanged. No new issues found.

Security Issues
None found.

Correctness Issues
None found.

Suggestions
None.

[github-actions]

No blocking issues found.

[linear-code]

CE-1025

[github-actions]

No blocking issues found.