[ABB65]

CI: postgres service image from the ECR Public mirror, pinned by digest

Why: the postgres-lineage job pulls its postgres:16 service image from Docker Hub and hits Docker Hub's anonymous pull limit; #449 is waiting on that check. This is the same fix as migrate#734 (web base image).

Change: .github/workflows/ci.yml, job postgres-lineage, service postgres:
postgres:16 → public.ecr.aws/docker/library/postgres:16@sha256:ca0bd484cb98bf4b24eb1010e73fb3fcbd6714d240fbc1a10eea5b7dbecb641d.
A comment above it records the reason, the date and the digest. Nothing else changes.

Digest check (2026-10-10, docker buildx imagetools inspect): both are an OCI image index (multi-arch, incl. linux/amd64), and the digests are identical:

• docker.io/library/postgres:16 → sha256:ca0bd484cb98bf4b24eb1010e73fb3fcbd6714d240fbc1a10eea5b7dbecb641d
• public.ecr.aws/docker/library/postgres:16 → sha256:ca0bd484cb98bf4b24eb1010e73fb3fcbd6714d240fbc1a10eea5b7dbecb641d

Other Docker Hub pulls in this repo (not changed here; ORK decides the scope):

• Dockerfile: three FROM node:22-slim lines (deps, build, runtime). release.yml builds this image on a release tag, so a release build can hit the same limit. Fix if needed: the same ECR digest migrate#734 pinned (node:22-slim@sha256:c3de60bf…).
• release.yml docker/setup-buildx-action@v4 pulls the moby/buildkit image from Docker Hub by default (it can be pointed elsewhere with driver-opts: image=…).
• No compose files. ci.yml has no other service images.

Proof:

• Locally, docker pull of the pinned ref worked; the workflow YAML parses and names the new image.
• CI on this PR is the proof: postgres-lineage green.

[ABB65]

ork2 review @e550e129: OK (1 file, ci.yml).

• The postgres-lineage service now pulls postgres:16 from the ECR Public mirror, pinned to index digest ca0bd484…, which t7 checked is the same on docker.io (2026-10-10). postgres-lineage is green on this PR.
• Follow-ups are listed in the body and not changed here: the studio Dockerfile's 3× node:22-slim (release.yml) and buildx's moby/buildkit default pull. Both can hit the same limit on a tag release.