fix(supabase-provision): rewrite transaction/6543 -> session/5432 for new projects (#1301)

[0xDevNinja]

Summary

• cmd_pooler_url in bin/gstack-gbrain-supabase-provision trusts db_port verbatim from the Management API. On a fresh Supabase project the API returns a single transaction-mode entry at port 6543, but the shared pooler tenant for new projects only listens on the session port 5432.
• Result: gbrain init hangs to TCP timeout (transaction port unreachable), then cascades into "tenant/user not found" / "password auth failed" errors that look like auth bugs. The reporter on /setup-gbrain: provision picks transaction pooler (6543) but new Supabase projects only listen on session pooler (5432) #1301 lost ~30 min to that misdiagnosis loop.

This PR adds a narrow rewrite: when the picked entry is pool_mode == "transaction" AND db_port == "6543", swap to session / 5432 and print a one-line stderr note. Every other shape (session/6543, transaction/5432, explicit array with a session entry) is untouched.

Set GSTACK_SUPABASE_TRUST_API_PORT=1 to disable the rewrite if a future API version starts returning a working transaction port.

Fixes #1301.

Why this shape

The reporter posted a verified band-aid in the issue body. I kept it intentionally narrow:

• Only rewrites the single known-bad combination (transaction + 6543). Doesn't touch session/6543 (some regions genuinely serve session on 6543, per the existing happy-path fixture in the test).
• Doesn't add a TCP-handshake probe inside wait — that's a separate fix the reporter also flagged. This PR is the immediate footgun stop; the probe-side work can land independently.
• Stderr note is opt-out, not opt-in, so users see what happened without reading the code.

Tests

test/gbrain-supabase-provision.test.ts already mocks the Management API end-to-end via Bun.serve. 5 new cases under describe('pooler-url'):

• transaction/6543 single object → rewritten to session/5432, with rewriting stderr note
• session/6543 → untouched (no rewrite log)
• transaction/5432 → untouched
• GSTACK_SUPABASE_TRUST_API_PORT=1 → rewrite suppressed, 6543 returned verbatim
• array with explicit session entry on 5432 → existing array-path behavior unchanged

bun test test/gbrain-supabase-provision.test.ts
# 33 pass, 0 fail (28 existing + 5 new)

The 7 pre-existing gen-skill-docs --dry-run freshness check failures on non-Claude hosts reproduce on upstream/main with this branch's changes stashed — unrelated to this patch.

Out of scope

The reporter flagged two adjacent issues in the same comment which I'm leaving for separate PRs:

• wait returning ACTIVE_HEALTHY too early before the pooler tenant routes propagate (needs a real TCP-handshake probe).
• gstack-gbrain-source-wireup --database-url <url> leaking the URL via ps aux (env-var-only intake, separate file).