[lin-crl]

Summary

• Adds an integration job to .github/workflows/ci.yaml. The tests in integration_test.py are the only ones that exercise a real server, and every one is skipUnless(CONFIGURED) — CI never set the variable, so that whole path was only ever covered on a laptop.
• The job starts the committed docker-compose.postgres-test.yml rather than a services: container: a service cannot override the image command, so it could not preload pg_stat_statements, and the suite would have quietly exercised the profiler's degradation path instead. Compose interpolates from the process environment in preference to a .env file, so a job-level env: replaces --env-file and writes no credential to disk.
• An opt-in suite fails open. A guard step asserts integration_test.CONFIGURED before the suite runs, so a green job means the tests actually ran rather than that they were configured out.
• TestCIWorkflow guards those properties as text assertions — the repository has no YAML parser and must not acquire one.

Credentials are the synthetic values docs/TESTING.md already documents. One deviation: the documented host db.invalid is reserved by RFC 2606 precisely so it cannot resolve, and this job has to connect, so it uses loopback.

Runs on Python 3.9 — the floor release.yaml gates on. The existing matrix already covers the offline path on everything newer.

Test plan

• python3 dbprofiler.py --check-safety
• python3 -m unittest — 403 tests, OK
• ruff check
• Workflow parses as YAML
• Mutation-tested the new guards against a mutated copy: dropping the skip guard, dropping if: always(), bumping the Compose image without the client check, moving the URL onto a command line, unpinning an action, and introducing a secrets. reference are each caught by the test named for them
• The integration job passes here — it could not be run locally (no psql/pg_dump on the author's machine), so this PR was its first real execution
• Job log reports Ran 71 tests ... OK, zero skipped, and the Compose container reported Healthy before the suite started. 71 is the count on main; the schema_by_table branch adds 8 more
• The guard step's exact command was checked directly: exit 0 with the URL set, exit 1 with it unset, exit 1 with it empty