fix(checks): build the postgres check connection from an explicit pq.Config

[fclairamb]

Fixes findings G1 and G2 of the security scan of 2026-10-17 (severity low).

Change

• The PostgreSQL check no longer builds a lib/pq conninfo string. buildPQConfig fills a pq.Config directly and openDB opens it with pq.NewConnectorConfig. A backslash or quote in a field can no longer add driver options (G1).
• The check no longer falls back to the worker's own PG* environment, ~/.pgpass or ~/.postgresql client certificate (G2). Passfile, SSLCert and SSLKey point to a path that cannot exist.
• BuildConnStr and escapePQParam are removed.
• Credentials containing a backslash or a quote now work.
• PGCONNECT_TIMEOUT on the worker no longer affects the check; the check timeout is used.

Tests

connector_test.go: hostile values arrive byte for byte in each field; a fake cleartext-auth server receives no ambient password with .pgpass, PGPASSFILE, PGPASSWORD and others set, and does receive the check's own password (positive control).

Spec archived: specs/done/2026/10/2026-10-17-01-postgres-check-connection-config.md.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 97.22222% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 83.23%. Comparing base (9d5fb1d) to head (4666bc4).

Files with missing lines	Patch %	Lines
...erver/internal/checkers/checkpostgres/connector.go	96.77%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #584      +/-   ##
==========================================
- Coverage   83.23%   83.23%   -0.01%     
==========================================
  Files        1207     1208       +1     
  Lines      124151   124147       -4     
==========================================
- Hits       103340   103335       -5     
- Misses      20802    20803       +1     
  Partials        9        9              

Files with missing lines	Coverage Δ
server/internal/checkers/checkpostgres/checker.go	40.44% <100.00%> (-3.89%)	⬇️
...r/internal/checkers/checkpostgres/config/config.go	65.78% <100.00%> (-1.21%)	⬇️
...internal/checkers/checkpostgres/config/validate.go	93.75% <100.00%> (ø)
...erver/internal/checkers/checkpostgres/connector.go	96.77% <96.77%> (ø)

... and 12 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.