Harden CI and switch release builds to tagged immutable images

sqlc.yaml

@@ -0,0 +1,16 @@
+version: "2"
+sql:
+  - engine: postgresql
+    schema: db/migrations
+    queries: db/queries
+    gen:
+      go:
+        package: dbgen
+        out: internal/adapters/postgres/generated
+        sql_package: pgx/v5
+        emit_db_tags: true
+        emit_empty_slices: true
+        emit_interface: true
+        emit_json_tags: true
+        emit_pointers_for_null_types: true
+