Unify §3 test overlaps (todo §3); fold the 5× image-pin checks into one compose.test.ts scan + same-version sidecar test, drop the duplicate committed-JWKS re-validation in config.test.ts

src/postgres.test.ts

@@ -1,6 +1,6 @@
-// Guards the Ory Postgres config (§3): image stays pinned to an exact version
-// (AGENTS.md rule) and each Ory service keeps its own database. Real container
-// behaviour is verified by booting postgres in CI/e2e; this catches edits.
+// Guards the Ory Postgres config (§3): each Ory service keeps its own database (the
+// image pin is covered by compose.test.ts's global scan). Real container behaviour is
+// verified by booting postgres in CI/e2e; this catches edits.
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
@@ -8,13 +8,6 @@ import { readFileSync } from "node:fs";
 const read = (p: string) => readFileSync(new URL(`../${p}`, import.meta.url), "utf8");
 const ORY_DATABASES = ["hydra", "keto", "kratos"]; // one DB per Ory service
 
-test("compose pins the postgres image to an exact version", () => {
-  const tag = read("compose.yml").match(/image:\s*postgres:(\S+)/)?.[1];
-  assert.ok(tag, "compose.yml pins a postgres image");
-  assert.match(tag, /^\d+\.\d+/, `${tag} pins major.minor`);
-  assert.doesNotMatch(tag, /latest|[\^~*]/, `${tag} is exact, not floating`);
-});
-
 test("init SQL gives each Ory service its own database", () => {
   const sql = read("ory/postgres/init/init.sql");
   for (const db of ORY_DATABASES) {