fix(infra): scope the DAO API DB image and cover its entrypoint in CI

.changeset/olive-pandas-guard.md

@@ -0,0 +1,6 @@
+---
+---
+
+Scope the DAO API database image to its own watch patterns and cover its
+entrypoint derivation with a CI self-test. Infra and CI only — no workspace
+package changes.

.github/workflows/tests.yaml

@@ -424,6 +424,24 @@ jobs:
           flags: api
           fail_ci_if_error: false
 
+  dao-api-db-entrypoint:
+    name: DAO API DB entrypoint self-test
+    if: ${{ !(startsWith(github.head_ref, 'changeset-release/') && github.actor == 'github-actions[bot]' && github.event.pull_request.user.login == 'github-actions[bot]' && github.event.pull_request.head.repo.full_name == github.repository) }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # The entrypoint derives max_connections and effective_cache_size from the
+      # container's own cgroup limit, so a wrong derivation silently mis-provisions
+      # every DAO database at once — and the tiers it keys off are not visible from
+      # the repo. The script ships assertions for the four fleet tiers, both clamp
+      # boundaries and both fallback paths; this runs them on every PR instead of
+      # relying on someone remembering to.
+      - name: Run entrypoint self-test
+        run: bash infra/dao-api-db/entrypoint.dao-api-db.sh --self-test
+
   # dashboard-e2e:
   #   name: Dashboard E2E
   #   needs: wait-for-gateful

infra/dao-api-db/dao-api-db.railway.toml

@@ -1,6 +1,11 @@
 [build]
 builder = "DOCKERFILE"
 dockerfilePath = "infra/dao-api-db/Dockerfile.dao-api-db"
+# Railway watches the whole repo when this is unset, so without it every merge to
+# dev rebuilds and restarts all 17 Postgres services at once. Nothing outside the
+# image's own directory can change what this service runs, and the image is shared
+# by the whole fleet, so the pattern is the same for every DB service.
+watchPatterns = ["infra/dao-api-db/**"]
 
 [deploy]
 # No healthcheckPath: Postgres speaks the wire protocol, not HTTP, so Railway's