fix(db): paren-insensitive constraint-drift comparison

pg_get_constraintdef's AND-chain grouping changed between Postgres minors:
17.4 prints left-associated parentheses, 17.6 flattens the chain. The pinned
definitions came from the 17.4 production dump, so the drift check false-fired
on a fresh 17.6 project (and would fire on production after its next minor
upgrade). Comparing both sides with parentheses stripped keeps the check's
purpose — operator, literal, and regex changes still surface.

Author: iamjr15

scripts/supabase-target/invariants.ts

@@ -181,7 +181,15 @@ export async function validateIntegrityConstraints(client: PgClient): Promise<st
     CANONICAL_PROVIDER_KEY_CONSTRAINT,
   ]) {
     const row = result.rows.find((candidate) => candidate["conname"] === contract.name);
-    if (row && normalizedSqlDefinition(row["definition"]) !== contract.definition) {
+    // pg_get_constraintdef's AND-chain grouping changed between Postgres
+    // minors (17.4 prints left-associated parentheses, 17.6 flattens), so the
+    // comparison ignores parentheses. Operator, literal, and regex changes
+    // still surface, which is what this drift check exists to catch.
+    if (
+      row &&
+      parenInsensitiveSqlDefinition(row["definition"]) !==
+        parenInsensitiveSqlDefinition(contract.definition)
+    ) {
       issues.push(`Security check public.${contract.tableName}.${contract.name} has drifted.`);
     }
   }
@@ -261,3 +269,7 @@ function stringField(row: Record<string, unknown>, key: string): string | undefi
 function normalizedSqlDefinition(value: unknown): string {
   return typeof value === "string" ? value.replaceAll(/\s+/g, " ").trim() : "";
 }
+
+function parenInsensitiveSqlDefinition(value: unknown): string {
+  return normalizedSqlDefinition(value).replaceAll(/[()]/g, "").replaceAll(/\s+/g, " ").trim();
+}