#244 feat(ci-deploy): pg_dump snapshots verify TLS with the application's CA ConfigMap

Prod (agentrelay-prod) snapshots its Control database on Supabase with pg_dump before every apply. The URL uses sslmode=verify-full, but the CodeBuild job has no Supabase CA. A pg_dump database entry can now name ca: {configMap, key}, in the same namespace. That CA, the one relay-control already trusts (supabase-ca), becomes PGSSLROOTCERT for the dump.

New test included (30 pass); shellcheck is clean.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Allows pg_dump snapshot entries to specify a CA ConfigMap, so database URLs with sslmode=verify-full (like Supabase poolers) dump using the same trust anchor the application uses.

• Adds an optional ca: {configMap, key} field to a pg_dump database entry; when present, that CA is written to a file and exported as PGSSLROOTCERT for the dump, then unset per entry.
• When the URL itself has an sslrootcert (often a pod-only path), the configured CA replaces it, since libpq favors the URL value over PGSSLROOTCERT, while preserving the URL's percent-encoding.
• Documents the new field and includes tests covering CA-based verification, URL sslrootcert replacement, and preserved percent-encoding.