fix: exclude test-origin queries from the gate (bump core to 0.13.0)

[veksen]

Goal

Stop the new-query gate from phantom-blocking PRs on Query Doctor's own repo — including docs-only ones — with queries that were never added by the PR. Fixes Query-Doctor/Site#3606.

What

Before: the analyzer / Analyzer check failed with "N new queries ship with a high-impact index recommendation", listing Query Doctor's own test read-backs of project_queries (SELECT "normalized_fingerprint" FROM "project_queries" WHERE "hash" = $1 and its full-row sibling, cost 17, 51% cut). These recur on every run against every baseline, so a rebase doesn't clear them.

After: those queries are recognized as test-origin and bucketed out of the gate, matching what the Site API already does. A genuinely new query still gates.

How

Root cause is a client/server version skew of one shared rule:

• The flagged queries are raw db.select() read-backs in apps/api/src/projects/project-queries.repository.spec.ts (lines 479 and 506, helper readFingerprint). Their SQLCommenter file tag is …project-queries.repository.spec.ts:509:10 — a :line:col suffix on the path.
• isTestOriginQuery must strip that suffix before the $-anchored .spec.ts pattern can match. Core 0.12.1 added the strip. The Site API adopted it (it stopped storing these queries around July 15), but the analyzer bundled an older core (installed 0.10.10), so compareRuns never moved them to testOriginExcluded — they stayed in newQueries and the gate fired. Since the server never stores them, no stored baseline ever contains them, so they read as "new" run after run.

The fix is the dependency bump; there is no gate-logic change. Read package.json first, then src/remote/api-client.ts, then the test.

• @query-doctor/core ^0.12.0 → ^0.13.0 so the analyzer applies the same test-origin rule as the server.
• 0.13.0 adds runQuery to the ClientApi RPC surface. The CI ApiClient doesn't implement it (nothing calls it there), so its stub now throws to satisfy the new return type rather than silently returning undefined.

Verified against the prod Site DB: the two runs behind #3606 store an identical 91-hash set as their baselines (server rollup new: 0), and the catalog shows these two hashes with last_seen_source = ci frozen at 2026-07-15 01:00 — the point the server started dropping them.

Tests

• New compareRuns case: a .spec.ts query whose file tag carries a :line:col suffix is excluded (testOriginExcluded, not newQueries). Fails on pre-0.12.1 core, passes now.
• Full suite green (29 files, 307 tests), typecheck clean.

Follow-up (deploy, not in this PR): cut a new analyzer action release so CI runs pick up the bumped core.

🤖 Generated with Claude Code

[github-actions]

Query Doctor Analysis

3 queries analyzed

0 regressed · 0 improved · 0 new · 0 removed

2 pre-existing issues

• SELECT "guests"."id", "guests"."session_id", "guests"."username", "guests"."avatar_path", "guests"."color", "guests"."side", "guests"."audio_recording_path", "guests"."audio_recording_public", "gue...
  index assets(event_id, inserted_at desc)
  cost 31,003,449 → 1,498 (100% reduction)
• SELECT * FROM guest_ip_addresses WHERE ip_address = '127.0.0.1';
  index guest_ip_addresses(ip_address)
  cost 154,402 → 8 (100% reduction)

_{Using assumed statistics (10000000 rows/table). For better results, sync production stats.}

_{More detail → get_ci_run({ runId: "019f8640-521a-7a4e-93a2-b35c9108a864" }) · view run · docs}