fix: harden the Postgres persistence tier

[FlyM1ss]

Batch B of the agent-persistence follow-ups — three issues, one tier.

• Closes Postgres twins have no lazy-migration path #135 — the agent twin gains a lazy-migration path (ALTER … ADD COLUMN IF NOT EXISTS for the 5 folded columns). Without it, a future column added only to CREATE TABLE no-ops on prod's existing table → UndefinedColumn 500s the whole agent surface while /health stays green. New @pg_only test recreates the pre-migration table to force the migrate path (RED before the fix, GREEN after). Scoped to the agent twin deliberately: it's the only twin with a folded migration history; version/strategy shipped complete and keep their documented convention.
• Closes Postgres tier has five known coverage gaps #137 — five @pg_only coverage gaps closed: claim/reclaim, raw scopes default (read straight from the column, since _public_agent's or DEFAULT_SCOPES masks a wrong empty default), last_used_at touch-on-use, listing ORDER BY, and widen-path nbytes. Each was mutation-tested — inject the targeted bug, confirm the test goes red, revert.
• Closes CI tests Postgres 16, prod Neon runs 18.4 #138 — CI Postgres 16 → 18-alpine to match prod Neon 18.x.

Verified on a local postgres:18-alpine: full suite 1113 passed / 5 skipped / 0 failed with the live tier on.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agentic-trading-lab	Ready	Preview, Comment	Jul 18, 2026 9:07am

[FlyM1ss]

Pushed c999e96 — self-review follow-ups:

• Migration test → populated-table case. test_agent_schema_lazily_migrates_an_old_table_postgres now seeds a real legacy row before re-running _init_schema, then asserts the ADD COLUMN … NOT NULL DEFAULT backfilled agent_type/scopes on it (raw column read, bypassing _public_agent's scopes masking). That's the actual prod scenario — a populated pre-migration table where a NULL scopes would be an authz hole — not just an empty table gaining columns.
• Ordering test clock. Swapped the fixed 6-item iterator for an unbounded itertools.count, so a change in create_agent's _utcnow_iso call count surfaces as a clean assertion failure instead of StopIteration.
• Doc version consistency. Bumped the remaining postgres:16-alpine → 18-alpine refs in this workstream's plan/spec docs to match the shipped CI (CI tests Postgres 16, prod Neon runs 18.4 #138).

Verification: full non-pg suite green locally (1095 passed / 23 skipped / 0 failed). The @pg_only assertions weren't run locally (no Docker engine reachable here) — CI's pg18 tier is the live gate for them.

Out of scope, flagging: docs/superpowers/plans/2026-07-08-user-account-persistence-fix.md still has two postgres:16-alpine refs, but that's the earlier user-account workstream's doc — left untouched.