refactor(cli): cover db shared helpers with effect lint (CLI-2409)

[7ttp]

TL;DR

brings the shared db helpers under the effect lint

whats introduced?

effect lint applied to db/shared:

• one allow list entry for db/shared
• DeclarativeSeam members are plain effects instead of thunks, with their callers and mocks updated
• the pg-delta adapter runs each library call through its own typed try, keeping the same error messages and operations
• SUPABASE_SSL_DEBUG reads through Config, still off when unset or empty
• debug ids and artifact names come from DateTime, and json files encode through Schema with the same two space layout, now pinned byte for byte
• five diagnostics tests that returned an effect without running it now run
• tests use FileSystem and Path, and cause assertions use Cause.pretty

ref:

• related: CLI-2409

[github-actions]

🤖 AI Review

Both independent reviews were available. The sorting test has a confirmed coverage regression, and two JSON helpers add a confirmed style concern. No runtime defect was identified. The test suite was not run because dependencies are not installed.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/commands/db/shared/shadow-source.unit.test.ts:431	test-coverage	codex	The UTF-8 versus UTF-16 sorting test no longer uses filenames whose order differs between the two comparators.
⚪ NIT	apps/cli/src/commands/db/shared/pgdelta-files.ts:27	lint-evasion	claude	The new JSON helpers merely wrap native parse and stringify calls without adding behavior.

Stats

Claude findings: 1 · Codex findings: 1 · Confirmed: 2 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[avallete]

Effect-lint coverage for the shared db helpers looks mechanical.

Seam methods are effect values with the same bodies. startLocalDatabase uses Effect.mapError for the same typed error Effect.catch was failing with. The pg-delta adapter still extracts source and desired together with Promise.all. loadTargetUserSchemas maps only the inner connect/query block; a bad connection string still fails before that pipe, and scope close stays outside it. SUPABASE_SSL_DEBUG via Config still treats TRUE as on and empty/unset as off. Debug ids and pretty JSON match the old toISOString / JSON.stringify output. Existing tests are still there; symlink, non-directory schema, and render-failure cases were added.