test(hubdb): eliminate approval-expiry clock-boundary flake

[gnanirahulnutakki]

Summary

• derive pre-approval and expired integration fixtures from PostgreSQL statement_timestamp() instead of the host clock
• place them five minutes inside the future/past side of the production half-open interval
• preserve and assert the exact immutable ten-minute grant lifetime before exercising refusal paths

Root cause and boundary

The former expired fixture set approved_at from host time.Now() exactly ten minutes in the past, making expires_at approximately host now. A slightly slower container database clock could therefore still satisfy statement_timestamp() < expires_at and validly consume the supposedly expired test row.

This PR changes only the PostgreSQL integration fixture. Production remains database-clock authoritative and unchanged: approved_at <= statement_timestamp() AND statement_timestamp() < expires_at. No API, schema, lifetime, authorization, audit, or runtime behavior changes.

PostgreSQL documents statement_timestamp() as the current statement start time: https://www.postgresql.org/docs/current/functions-datetime.html#FUNCTIONS-DATETIME-CURRENT

Proof

• focused PostgreSQL integration: pass
• 50 consecutive race-enabled PostgreSQL approval runs: pass in 272.093s
• make e2e-isolation: pass, including PostgreSQL 18.4 and two 50,000-execution workspace fuzz campaigns
• make ci: pass; zero lint findings and no known Go vulnerabilities
• make release-check: pass with isolated GOPATH, dual reproducible four-platform archives, SPDX SBOMs, formula, and amd64/arm64 OCI layout
• make e2e-kind: pass in 512.852s across fleet fan-out, OCI, and Argo projection
• independent CodeRabbit uncommitted and exact committed passes: zero findings
• final teardown: no Kind clusters or isolated release builder
• GitHub-verified SSH-signed DCO/GSTACK commit: 8ce5d0a43032e2864dc0e9785521376416052676

README was reviewed; no update is needed because the documented production contract and operator behavior do not change. This adds no runtime or cloud cost.

Closes #304

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 84353e01-a929-4986-80c2-8209ed0734d3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch gnanirahulnutakki/fix-approval-expiry-clock-20260722

---

_{Comment @coderabbitai help to get the list of available commands.}

[gnanirahulnutakki]

Independent local CodeRabbit review completed twice on the one-file test-only diff: uncommitted pre-signing pass and exact committed-head pass both returned zero findings.

The production query, schema, ten-minute lifetime, API, authorization, and audit behavior are unchanged. The fixture now uses PostgreSQL statement time on both sides of the same half-open interval, with safe margins.