feat(infra): activate tuist_ops_ro for the Atlas DB runner

What

Activates the least-privilege role for the internal Atlas DB query runner: sets TUIST_ATLAS_DB_READONLY_ROLE: tuist_ops_ro in production. The runner now does SET LOCAL ROLE tuist_ops_ro for operator SQL, so writes are blocked by role privileges, not only by the read-only transaction.

Final step of the series — #11519 (endpoint + hardening) and #11567 (declarative tuist_web → tuist_ops_ro membership) are merged.

⚠️ Merge/deploy only after confirming CNPG reconciled the membership

The SET LOCAL ROLE requires the membership #11567 added to be live on the cluster. Verify first:

SELECT g.rolname AS member, r.rolname AS role, m.inherit_option
FROM pg_auth_members m
JOIN pg_roles r ON r.oid = m.roleid
JOIN pg_roles g ON g.oid = m.member
WHERE r.rolname = 'tuist_ops_ro' AND g.rolname = 'tuist_web';
-- expect one row with inherit_option = 'f'

If that row isn’t present yet, deploying this would make every Atlas DB query raise on SET LOCAL ROLE. (Rollback is trivial: revert this one value and the runner falls back to the web role behind the read-only transaction.)

🤖 Generated with Claude Code

No GitHub comments yet.