chore(compose): add db-test service for pytest isolation

Production DB at port 5432 holds live orchestrator state. The
tests/conftest.py autouse reset_state fixture runs TRUNCATE
against every table before every test. Today this connects to
the production DB and wipes working state silently.

Add a separate Postgres on port 5433 with its own volume and
credentials (damascus_test / damascus_test / damascus_test).
The conftest patch (filed as kanban task t_82790f84) will point
its DSN at db-test:5432 from inside the container and
127.0.0.1:5433 from the host, leaving prod untouched.

Bind-mount binding added: no new containers in the topology map
(db-test sits alongside db on the same Docker network).

docker-compose.yml

@@ -44,6 +44,37 @@ services:
       timeout: 5s
       retries: 20
 
+  # Test-only Postgres for the pytest suite. The tests/conftest.py
+  # autouse `reset_state` fixture must NEVER touch the production DB
+  # (port 5432, holds live orchestrator state). Connect to `db-test:5432`
+  # from inside the orchestrator container, or `127.0.0.1:5433` from the
+  # host. Separate volume, separate credentials.
+  db-test:
+    image: postgres:16
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: damascus_test
+      POSTGRES_PASSWORD: damascus_test
+      POSTGRES_DB: damascus_test
+    volumes:
+      - dbtestdata:/var/lib/postgresql/data
+    ports:
+      - "127.0.0.1:5433:5432"
+    healthcheck:
+      test: ["CMD", "pg_isready", "-U", "damascus_test", "-d", "damascus_test"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+    command: >
+      bash -c '
+        if [ -n "$$(ls -A /var/lib/postgresql/data 2>/dev/null)" ] \
+           && [ ! -f /var/lib/postgresql/data/PG_VERSION ]; then
+          echo "[db-test] tainted data dir detected (no PG_VERSION); wiping /var/lib/postgresql/data/* before initdb";
+          rm -rf /var/lib/postgresql/data/* /var/lib/postgresql/data/.[!.]*;
+        fi;
+        exec docker-entrypoint.sh postgres
+      '
+
   orchestrator:
     build: .
     image: damascus-orchestrator:latest
@@ -249,6 +280,7 @@ services:
 
 volumes:
   dbdata:
+  dbtestdata:
   orchdata:
   worktrees:
   projects: