Builds and tests are driven entirely by scripts/ci/*.sh so every step
(build, test, image build/push, QA deploy) can be run identically in
CI or on a workstation. QA runs as an isolated docker-compose stack
with its Postgres volume wiped and recreated on each deploy.
