ci.yml gains a postgres:16 service; alembic upgrade/downgrade/upgrade
round-trip runs on PG, unit tests run -m "not integration", and the
roles.sql integration suite runs with a postgresql-client install.
(Gate executed locally against Postgres 18.6 — see PR description.)