fix(infra): hand the ingest gateway a Postgres URL its client can parse

[Makisuo]

What broke

The production deploy of 3b300e6 (#972) failed with ServiceDidNotStabilize on the ingest ECS service after 28 minutes. Every task on the new task-definition revision exits 1 at boot:

Key store init error: invalid MAPLE_PG_URL: invalid connection string

ECS kept the previous revision's two tasks running, so ingest never stopped serving. The failed deployment is still cycling new tasks every five minutes until a good revision lands.

Why

#972 feeds the fleet's maple-pg-url secret from the new Planetscale.PostgresRole's connectionUrlPooled. alchemy renders that URL with ?sslmode=verify-full. The gateway parses it with tokio-postgres 0.7.18, whose URL parser accepts only disable, prefer and require and reports anything else as "invalid connection string" (the inner "invalid value for sslmode" is dropped by the {error} format, which only prints the top of the chain).

Change

apps/ingest/alchemy.run.ts: map the role's URL through Output.map and rewrite sslmode=verify-full to sslmode=require before it reaches the secret. The gateway's rustls connector verifies the certificate chain and hostname under require regardless, so the connection guarantee is unchanged. Stages without a database branch still read MAPLE_INGEST_PG_URL untouched.

Follow-up worth doing separately: teach the Rust side to accept verify-full (or print the error chain at that boundary) so the next unsupported option is diagnosable from the log line alone.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 910b4f16-2911-47a2-9d5e-5be7464d942a

📥 Commits

Reviewing files that changed from the base of the PR and between 49df32f and 2e92863.

📒 Files selected for processing (1)

• apps/ingest/alchemy.run.ts

 ________________________________________________
< Love the optimism of `// should never happen`. >
 ------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}