fix(cnpg): the grant reconciler died on every Flux-managed run

The SQL asserted convergence in a dollar-quoted PL/pgSQL DO block. That
cannot survive this delivery path: the ConfigMap is rendered through Flux's
postBuild substitution, and envsubst collapses a doubled dollar into one, so
Postgres received a half-quoted DO and failed with a syntax error. Three
scheduled runs had left nine Error pods in nextcloud-db.

It passed verification because it was hand-applied with kubectl, which runs
no envsubst — the defect only existed once Flux owned the object. The GRANT
on the first line still succeeded, so the privilege held and the blind spot
stayed closed; what was broken was the assertion meant to prove it, which is
the part that makes a silent regression visible.

Rewritten in plain SQL with no dollar sign anywhere in the file, comments
included. Escaping by doubling again would also work and would be the next
person's trap. has_database_privilege()::int is 1 or 0, so the division
raises division_by_zero and ON_ERROR_STOP=1 fails the Job; the divisor is
not constant so it cannot be folded away at plan time.

Co-Authored-By: Claude Opus 5 <[email protected]>

apps/wave-0/nextcloud-db.yaml

@@ -381,11 +381,20 @@ data:
 
     -- Fail the Job if the privilege is somehow still absent, so a broken
     -- reconciler surfaces as a failed Job rather than as a quiet blind spot.
-    DO $$
+    -- NO PL/pgSQL, AND NOT ONE DOLLAR SIGN IN THIS FILE — DELIBERATE, including in these
-    BEGIN
+    -- comments. This assertion began life as a dollar-quoted DO block, which cannot survive
-      IF NOT has_database_privilege('cnpg_metrics_exporter', 'nextcloud', 'CONNECT') THEN
+    -- being shipped this way: the ConfigMap is rendered through Flux's postBuild
-        RAISE EXCEPTION 'cnpg_metrics_exporter still lacks CONNECT on database nextcloud';
+    -- substitution, and envsubst collapses a doubled dollar into a single one. The block
-      END IF;
+    -- reached Postgres with its opening quote halved and every Flux-reconciled run died
-      RAISE NOTICE 'converged: cnpg_metrics_exporter has CONNECT on database nextcloud';
+    -- with a syntax error pointing at that character.
-    END
+    -- It PASSED when hand-applied with kubectl, because that path runs no envsubst — so
-    $$;
+    -- the defect was invisible until Flux owned the object, and three runs of Error pods
+    -- were the first sign. Escaping by doubling again would work and would also be the
+    -- next person's trap; plain SQL leaves substitution nothing to touch.
+    --
+    -- has_database_privilege() returns boolean; ::int is 1 when granted and 0 when not, so
+    -- the division raises division_by_zero and ON_ERROR_STOP=1 fails the Job. The divisor
+    -- is not a constant, so it cannot be folded away at plan time.
+    \echo 'asserting cnpg_metrics_exporter has CONNECT on database nextcloud'
+    SELECT 1 / has_database_privilege('cnpg_metrics_exporter', 'nextcloud', 'CONNECT')::int
+      AS exporter_can_connect;