test(ci): deploy-failure auto-debug path + anon-stack gap + with_failed_deploy factory (#70)

[mastermanas805]

Failure-diagnosis CI integration tests for the deploy-failure AUTO-DEBUG PATH, api side (task #70, source docs/ci/02-FAILURE-DIAGNOSIS-AND-AUTODEBUG.md §5). Cross-referenced with the worker PR (producer↔consumer schema parity).

What this adds

1. Auto-debug PATH integration test — deploy_autodebug_path_test.go

Seeds a status=failed deployment + an older lifecycle row + a failure_autopsy deployment_events row (reason/exit_code/last_lines/hint) against a real test DB, then asserts the full agent debug loop as ONE coherent contract:

• GET /api/v1/deployments/:id → status=failed + non-empty error_message
• GET /api/v1/deployments/:id/events → autopsy with reason + non-empty last_lines + hint, newest-first, count correct
• auth-negative: no/invalid bearer → 401
• cross-team: another team's token → 404 (no existence leak, never 403)

2. Anonymous-stack failure-diagnosis contract — stack_anon_failure_diag_test.go

Drives an anon stack (NULL team_id) to failed; asserts GET /stacks/:slug (slug-bearer, no auth) returns status=failed and the raw build error is persisted on the service row. Pins the documented gap: enumerates the LIVE router (router.New + GetRoutes) and asserts NO /stacks/:slug/events route exists. Anon failure-diagnosis is status + logs only (no classified autopsy) — adding a stack-autopsy endpoint later reds this test deliberately.

3. with_failed_deploy factory flag — internal_e2e_account.go

Cohort-only, inert-by-default pre-seed of ONE failed deployment + ONE failure_autopsy event via the production deploy models (CreateDeployment → UpdateDeploymentStatus → UpsertDeploymentAutopsy), surfaced as failed_deploy_id, reaped with the team. Lets the web wave load /app/deployments/:id and render the FailureAutopsyPanel against a real backend (not a mock).

Tests: seeds exactly one failed deploy + one autopsy with the factory payload; omitting seeds none; seam-driven seed_failed 503; whitebox sqlmock coverage of all three seed error branches.

Factory contract (for the web agent)

POST /internal/e2e/account body {"tier":"pro","with_failed_deploy":true} → response includes failed_deploy_id. Navigate to /app/deployments/<failed_deploy_id> or GET /api/v1/deployments/<failed_deploy_id>{,/events}.

Gates

make gate green except two pre-existing local-only flakes OUTSIDE this diff (internal/models/TestLinkGitHubID shared-DB pollution; handlers/TestQueue_CredIssueError_FallsBackToLegacyOpen NATS flake) — both in untouched packages. CI (fresh DB, Go 1.25) is authoritative. New tests + donebar / manner-matrix / error-envelope guards all pass.

🤖 Generated with Claude Code

[mastermanas805]

Cross-ref: worker producer↔consumer schema-parity PR is InstaNode-dev/worker#96. The api /events read surface here + the worker autopsy write there are asserted schema-compatible by worker#96's TestAutopsySchemaParity_* (last_lines encoding + column set).