feat(ci): audit the fleet for the Supabase we retired

[catomean]

Why

The fleet self-hosts Supabase on bitbaum. Two managed-cloud projects are dead — orangecat's ohkueislstxomdjavyhs (retired 2026-06) and botsmann's jkjmhtirxwhljpkcfxqe before it. The repos kept describing them in the present tense.

botsmann's setup doc opened with "✅ Completed Setup" for its dead project and said to apply migrations by pasting SQL into a supabase.com dashboard. Two scripts printed the same instruction, one handing out a psql string against pooler.supabase.com, and the CLI's cache with the old project ref was committed twice. Nobody pasted anything, its eleven migrations were never applied, and /api/health served PGRST205 for months while every deploy went green.

The docs were not stale clutter — they were the outage. A wrong pointer to a real-looking place is worse than no pointer: no pointer makes someone ask, a plausible one makes them assume it was handled.

Why audit, rather than trust the cleanup

The first live sweep found one more of exactly the same shape. printcraft/scripts/seed-roli-project.ts hardcoded the retired host and omitted db: { schema } — so repointing it naively at the box would have written one customer's project rows into orangecat's public. Deleted in bitbaum/printcraft#30. The remaining live instruction, orangecat/.env.example, is fixed in bitbaum/orangecat (linked below).

What it is

scripts/ci/hosted-supabase-audit.sh — central, not a copy per repo, the rule this repo exists to keep. Three repos use Supabase and thirty do not. botsmann additionally keeps a local check:selfhost in its own verify, deliberately: it's the repo the outage happened in, and blocking the commit beats finding it a week later.

Two judgements decide whether this is useful or merely loud, both pinned by 28 tests:

• It allows supabase.com/docs — the product documentation is still correct for us, only the control plane isn't — and your-project.supabase.co, because a placeholder misleads nobody. A gate that fires on either gets muted, and a muted gate protects nothing.
• Legitimate mentions go in the baseline with a reason, not into a widened pattern. A decommission runbook has to name what it decommissioned. hosted-supabase.baseline is a ratchet: it may fall or hold, never rise without a human deciding so in the same PR.

Transport, stated rather than hidden

Unlike verify-floor-audit.sh, this reads local checkouts: it's a full-text sweep, and GitHub code search returns nothing for these repos (verified — even a known-present token finds no hit), so the only remote option would be fetching every text file of every repo. The workflow shallow-clones the fleet into a temp DEV_ROOT and runs the same script unchanged.

When it sweeps nothing it prints SKIPPED, loudly, instead of a tick — a vacuous pass reads exactly like coverage, which is the failure this audit exists to prevent.

Verification

28/28 unit tests pass. Run live against all 35 local checkouts it correctly reported printcraft's hit gone after #30 merged, and named orangecat/.env.example as the one remaining — tracking reality, not a snapshot.