fix(ci): exclude adding-foreign-key-constraint squawk rule

Drizzle's migrator runs all statements in a single transaction, making
the two-step NOT VALID / VALIDATE pattern (squawk's recommended fix for
adding-foreign-key-constraint) impossible.

Excluded the rule with the same justification as the existing exclusions
for require-concurrent-index-creation and constraint-missing-not-valid.
agent_sessions is a small table (~hundreds of rows) so the brief
SHARE ROW EXCLUSIVE lock during migration is acceptable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: OAGr

.squawk.toml

@@ -22,12 +22,13 @@ pg_version = "16"
 #   by ensuring migrations only run once.
 #
 # require-concurrent-index-creation, disallowed-unique-constraint, constraint-missing-not-valid,
-# adding-not-nullable-field:
+# adding-not-nullable-field, adding-foreign-key-constraint:
 #   Drizzle's migrator runs ALL statements in a single transaction (see pg-core/dialect.js
-#   line 60). CREATE INDEX CONCURRENTLY cannot run inside a transaction, so these online-safe
-#   patterns are impossible with Drizzle. Tables are small (~700 rows) so brief locking is
-#   acceptable. If large-table migrations are needed in the future, use a separate raw SQL
-#   runner outside Drizzle.
+#   line 60). CREATE INDEX CONCURRENTLY cannot run inside a transaction, and the NOT VALID
+#   two-step pattern for FK constraints requires two separate transactions — both impossible
+#   with Drizzle. Tables are small (hundreds of rows) so brief locking is acceptable.
+#   If large-table migrations are needed in the future, use a separate raw SQL runner
+#   outside Drizzle (see .claude/rules/database-migrations.md for the manual migration pattern).
 excluded_rules = [
   "prefer-bigint-over-int",
   "prefer-identity",
@@ -38,4 +39,5 @@ excluded_rules = [
   "disallowed-unique-constraint",
   "constraint-missing-not-valid",
   "adding-not-nullable-field",
+  "adding-foreign-key-constraint",
 ]

apps/wiki-server/drizzle/0063_add_session_id_to_agent_sessions.sql

@@ -9,6 +9,11 @@
 -- 1. Older records predate this migration and won't have a session_id
 -- 2. Some agent sessions may never produce a session log (e.g., abandoned sessions)
 -- 3. Session logs can be created after agent sessions (at PR time)
+--
+-- Note: adding-foreign-key-constraint is excluded in .squawk.toml because Drizzle's
+-- migrator runs in a single transaction, making the two-step NOT VALID / VALIDATE
+-- pattern impossible. agent_sessions is a small table (hundreds of rows), so the
+-- brief SHARE ROW EXCLUSIVE lock is acceptable.
 
 ALTER TABLE "agent_sessions" ADD COLUMN IF NOT EXISTS "session_id" integer REFERENCES "sessions"("id") ON DELETE SET NULL;