fix(db): remove phantom ingestion_job_stages.job_id FK to match live (R24e)

[BigSimmo]

Summary

Implements state-machine finding R24e [FRESH-ENV-ONLY]: removes the phantom ingestion_job_stages.job_id → ingestion_jobs(id) foreign key that schema.sql (and migration 20260625000000) declare but the live project does not have.

Why remove (not add): verified read-only against live — the column holds indexing_v3_agent_jobs ids (the edge agent writes the agent-job id into job_id), not ingestion_jobs ids. Live carries ~253 orphan stage rows and 0 rows whose job_id resolves to an ingestion_jobs row. On any schema.sql- or migration-provisioned environment the FK makes every needs-work agent run die at its first stage insert (FK 23503) and burn attempts to terminal failed. The drift-allowlist's prior plan (ADD via NOT VALID + VALIDATE) would both destroy stage-log history and break the agent. Document cleanup stays covered by ingestion_job_stages.document_id → documents ON DELETE CASCADE (the FK live actually has).

This supersedes reconciliation-backlog item #8 in docs/database-drift-detection.md.

Changes

• supabase/migrations/20260708140000_drop_ingestion_job_stages_job_id_fk.sql — drop constraint if exists (idempotent; no-op on live, drops it on migration-replay envs).
• supabase/schema.sql — job_id uuid not null without the FK.
• supabase/drift-allowlist.json — removed the now-resolved missing_live entry.
• supabase/drift-manifest.json — removed the FK constraint entry + recomputed schema_sha256.
• docs/database-drift-detection.md — backlog item Bump gitleaks/gitleaks-action from 2 to 3 #8 marked reversed.
• tests/supabase-schema.test.ts — updated to pin the removal.

Verification

• npm run verify:cheap — green (offline drift-detection freshness/parity test + schema test both pass).
• npm run check:drift against live — the ingestion_job_stages_job_id_fkey divergence is gone (appears in neither the drift nor the stale-allowlist list). The remaining check:drift red is pre-existing and unrelated: the complete_ingestion_job/fail_or_retry/refresh_import_batch_status/cleanup_* entries are PR fix(ingestion): R1/R2 fences + R7/R9/R23 RPC hardening + R24e stage-FK removal #380 (merged, not yet applied to live) — they resolve when the operator applies fix(ingestion): R1/R2 fences + R7/R9/R23 RPC hardening + R24e stage-FK removal #380.

Note on the manifest

supabase/drift-manifest.json was hand-edited (one FK constraint object removed + schema_sha256 recomputed from the LF-normalized schema.sql) because the Docker drift:manifest replay was not responsive in this environment. A subtractive constraint removal cannot affect a from-scratch replay, normalizedSchemaSha256 is a plain sha of the file, and check:drift against live confirms the result — but a reviewer can run npm run drift:manifest to confirm byte-identical output.

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy due to reaching the limit of concurrent preview branches.
Go to Project Integrations Settings ↗︎ if you wish to update this limit.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[BigSimmo]

This branch duplicates #386 (same R24e FK drop). Recommend closing in favor of #386, which already has green CI and the Codex review fix for OCR retry targets.