CI runs no non-SQLite backend, so storage parity bugs ship unnoticed #804

AGENTS.md ("Verifying a change before calling it done", step 4) requires that a storage-layer change also run at least one non-SQL backend, because "this repo's whole storage layer is defined by that parity holding".

Nothing enforces it. .github/workflows/ contains buf.yml, ci.yml, govulncheck.yml, k8s.yml, release.yaml, scorecard.yml, and none of them references scylladb, couchbase, mongodb, arangodb or dynamodb. ci.yml runs Lint, Go tests (SQLite), govulncheck and Release smoke.

The Makefile already has everything needed — test-scylladb, test-couchbase, test-mongodb, test-arangodb, test-dynamodb, test-postgres, each self-contained (starts a container, waits, tears down, exits with the tests' status).

Why this is worth fixing now

#802 fixed two audit-log filter bugs that were invisible to CI:

1. Cassandra/ScyllaDB and Couchbase silently ignored resource_type, resource_id, from_timestamp and to_timestamp — returning unfiltered rows with no error.
2. On ScyllaDB, combining two indexed equalities without ALLOW FILTERING errored outright, so _audit_logs(action:, actor_id:) had never worked there.

Both were caught only by running the suite locally against real containers. Both had been shippable indefinitely.

A contributing factor worth fixing alongside: admin_audit_rest_test.go and admin_audit_grpc_test.go only ever pass action as a filter, so even the SQLite suite never exercised a second filter.

Suggested scope

• Add a matrix job for the non-SQL backends. Services are heavy, so gating on paths (internal/storage/**) or on a label is reasonable if a per-PR matrix is too slow.
• At minimum, scylladb and couchbase — the two backends whose query languages diverge most from the SQL path and the two that carried these bugs.