E2E Testcontainers integration suite

Closes gap-analysis v2 §7.8 (no E2E vs live Postgres / §10.8
(Testcontainers opt-in suite).

- tests/e2e/transactionLifecycle.e2e.test.ts — Postgres-backed E2E
  suite via @testcontainers/postgresql. Brings up a real postgres:15
  container, applies schema.sql (via pg simple-query protocol so $$
  function bodies survive) + migrations 002/003/004, wires the
  plans endpoints against it, and asserts:
    * POST /api/plans persists and reads back
    * eventBus.publish produces a hash-chained pair with verifyChain
      returning ok
    * idempotency_keys row insertion round-trips
- jest.e2e.config.js — dedicated config for tests/e2e/ with 120s
  timeout; default jest.config.js now ignores /e2e/ so `npm test`
  stays fast (<5s) and doesn't require Docker.
- package.json — adds 'npm run test:e2e' (sets RUN_E2E=1).
- devDependencies — testcontainers + @testcontainers/postgresql.
- Suite gates on `RUN_E2E=1`. Without it the describe block is
  skipped, so CI environments without Docker don't fail; a guard
  test asserts the skip invariant.
- .github/workflows/ci.yml — adds orchestrator-test (tsc + jest)
  and orchestrator-e2e (gated on the 'run-e2e' PR label or any
  push to main).
- Verification:
    npx tsc --noEmit              clean
    npm test (unit)               7 suites, 80/80 passing
    npm run test:e2e              1 suite, 4/4 passing (docker up)

.github/workflows/ci.yml

@@ -108,6 +108,48 @@ jobs:
         working-directory: orchestrator
         run: npm run build
 
+  orchestrator-test:
+    name: Orchestrator Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "18"
+          cache: "npm"
+          cache-dependency-path: orchestrator/package-lock.json
+      - name: Install dependencies
+        working-directory: orchestrator
+        run: npm ci
+      - name: Type check
+        working-directory: orchestrator
+        run: npx tsc --noEmit
+      - name: Unit tests
+        working-directory: orchestrator
+        run: npm test
+
+  orchestrator-e2e:
+    name: Orchestrator E2E (Testcontainers)
+    runs-on: ubuntu-latest
+    # Gap-analysis v2 §7.8 / §10.8 — opt-in E2E suite that brings up
+    # a real Postgres container and exercises the lifecycle against it.
+    # Gated on a workflow label so PR runs default to the fast unit
+    # suite; add the `run-e2e` label to a PR to include this job.
+    if: contains(github.event.pull_request.labels.*.name, 'run-e2e') || github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "18"
+          cache: "npm"
+          cache-dependency-path: orchestrator/package-lock.json
+      - name: Install dependencies
+        working-directory: orchestrator
+        run: npm ci
+      - name: E2E tests (Testcontainers Postgres)
+        working-directory: orchestrator
+        run: npm run test:e2e
+
   # Smart Contracts CI
   contracts-compile:
     name: Contracts Compile