fix(quality): stop CodeChangeAgent from overwriting Dockerfiles/.env.example; gate migration on a real database

[alimobrem]

Summary

Root-cause fix for the containerfile/companion generation gap flagged in the fleet-wide PR quality audit, followed by a full removal of CodeChangeAgent once the audit showed nothing worth keeping in it.

Part 1: Fix the root cause (not the skill-engine path -- that's correct)

The bug was not in the skill-engine's own pin/harden path (source_patches.py) -- that's verified correct -- it was the legacy CodeChangeAgent (agents/codechange.py), which ran alongside the skill engine for high-criticality/low-score apps and had its own unguarded dockerfile/container/secrets handlers.

Confirmed live, on PRs freshly regenerated after the #213/#214/#215 coverage-first quality pass had already shipped:

• PulseSRE/pulse-agent#2: deleted RUN pip install --no-cache-dir . and CMD ["pulse-agent-api"], changed COPY/WORKDIR, and left :latest unpinned on the very FROM line the finding was about.
• PulseSRE/pulse-ui#39: swapped the base image family (nginx -> nodejs), still ended in :latest, dropped ENTRYPOINT, and overwrote a real .env.example with a fabricated generic one -- violating the secrets category's own auto_pr=False detect-only contract.
• PulseSRE/pulse-ui#40: invented a schema_migrations_baseline table for a database-less React UI repo.

Changes:

• Removed dockerfile/container/secrets from CodeChangeAgent's dispatch (superseded by Part 2 below -- the whole agent is now gone).
• Hardened is_destructive_dockerfile_rewrite() as defense in depth: track CMD/ENTRYPOINT/EXPOSE token drops, and a base-image-family-swap guard.
• Gated the migration finding/skill on a real database dependency (analyzers/data_governance.py::has_database_dependency(), reusing stack_detector.DB_PATTERNS/DEP_FILES).

Verified end-to-end against the real, current pulse-agent/pulse-ui repo content through the actual delivery-time enrichment functions -- all Dockerfiles now pin correctly with RUN/CMD/ENTRYPOINT/COPY/WORKDIR preserved and no base-image swap; no .env.example generated; no migration finding/files for the database-less pulse-ui.

Part 2: Remove CodeChangeAgent entirely

Follow-up audit: with dockerfile/container/secrets removed, checked what was left and found nothing worth keeping.

Category	Status	Problem
health	Live	Duplicates the already-guarded workload-health-probes skill (K8s tcpSocket probes, no app code needed). CodeChangeAgent instead drops an unwired healthz.py/.js/.go stub -- the same "orphan stub" shape already fixed once for audit.py (pinky#8/#12).
logging/structured	Live	Contractually auto_pr=False in SOLUTION_CONTRACTS ("human wires logging") -- violated it, same bug class as secrets above.
instrumentation/otel/opentelemetry/tracing	Dead code	Also auto_pr=False by contract; no skill/analyzer currently emits these categories.
gitignore	Dead code	No analyzer ever emits this category.

Deleted agents/codechange.py, its agents/codechange.md registration, and tests/test_codechange_agent.py. AGENT_CLASSES is now always empty -- no Python onboarding agent remains at all; skills own every remediation domain. Updated orchestrator/capabilities/agent_registry_cleanup and portal wiring accordingly, and fixed every test that asserted the old "codechange gets planned for high-criticality" behavior -- several now inject a minimal fake Agent via AGENT_CLASSES/agent_filter to keep the real local/K8s-Job execution and crash-resilience code paths exercised now that no production Python agent exists to run them against.

The "codechange" string survives only as an internal category/branch-naming convention for delivery: source skill output (containerfile, db-migration-tooling, app-audit-logging, helm-chart, ...) -- decoupled from, and unrelated to, the deleted Python class of the same name.

Verification

uv run pytest: 3491 passed (full suite, twice, to rule out the transient Postgres-container flakiness this session has previously diagnosed).

Next steps (not done in this PR -- needs cluster access / deploy)

The 3 broken PRs above are still open. They should be closed and replaced by a fresh Scan once this merges and deploys -- I don't have live cluster access this session to trigger that Scan or verify the deployed commit.