HH-443: establish production CI and supply-chain evidence (#93)

* ci: enforce production release gates

* ci: close release gate review blockers

* ci: preserve verified digests during promotion

* ci: serialize and verify release cleanup

* ci: build govulncheck with Shangwutong toolchain

---------

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/database/upload_migration_test.go

@@ -48,7 +48,7 @@ func openUploadMigrationPostgres(t *testing.T) (*gorm.DB, string) {
 	require.NoError(t, err)
 	require.NotEmpty(t, migrationURL.Scheme, "GOCHAT_TEST_DB_URL must be a PostgreSQL URL")
 	query := migrationURL.Query()
-	query.Set("search_path", schema)
+	query.Set("search_path", schema+",public")
 	migrationURL.RawQuery = query.Encode()
 
 	db, err := gorm.Open(postgres.Open(migrationURL.String()), &gorm.Config{Logger: logger.Default.LogMode(logger.Silent)})