ci: enforce drizzle _query on every PR

Adds a 'Drizzle _query enforcement' step to the lint job that runs
`pnpm drizzle:query-check`. The oxlint rule already blocks the common
cases (db / ctx.db / this.db / tx / trx); the ts-morph verifier catches
the type-aware long tail so a renamed drizzle db can't sneak past. Both
exit non-zero on a fresh `.query` — verified by injecting a canary.

Author: RSO

.github/workflows/ci.yml

@@ -128,6 +128,9 @@ jobs:
       - name: Lint
         run: scripts/lint-all.sh
 
+      - name: Drizzle _query enforcement
+        run: pnpm run drizzle:query-check
+
   format-check:
     needs: changes
     runs-on: ${{ vars.RUNNER_DEFAULT_LABEL || 'ubuntu-latest' }}

scripts/drizzle-query-rename.ts

@@ -173,7 +173,7 @@ console.log(`[drizzle-query-rename] total: ${hits.length} hit(s) in ${byFile.siz
 
 if (CHECK) {
   console.error(
-    '[drizzle-query-rename] failing: use `pnpm drizzle:rename` or `oxlint --fix` to migrate.'
+    '[drizzle-query-rename] failing: use `pnpm drizzle:query-rename` or `oxlint --fix` to migrate.'
   );
   process.exit(1);
 }