feat(cli): test only the minimal covering set of modules by default

[pyramation]

Summary

pgpm test-packages gave every module its own database and re-deployed that module's
entire dependency closure into it. On constructive-db (89 modules) that is 1575 module
deploys, with ast deployed 26 times, ast-plpgsql 23, metaschema 19 — all of it
duplicate work, which is why --full-cycle is too slow to run in CI and how a batch of
revert/second-deploy bugs reached main unnoticed.

The default is now the minimal covering set: the modules nothing else in the workspace
requires. Testing one deploys its whole closure in dependency order, so every module is
still deployed/verified/reverted/re-deployed — just once per covering module. On
constructive-db: 16 databases instead of 89, 339 module deploys instead of 1575.

Minimal covering set: 16 of 89 modules (73 covered transitively; --force-all to test each on its own)

Selection runs over the post-exclude candidates, so --exclude functions-local promotes
constructive-local and app rather than silently dropping what only functions-local
covered.

// closures restricted to the candidate set, via the same resolver deploy uses
closures[name] = resolveExtensionDependencies(name, moduleMap).resolved
  .filter(dep => dep !== name && candidates.has(dep));

selected = candidateNames.filter(name => !coveredBy.has(name));
// then assert union(closures[selected]) === candidates, or throw

The property the default trades away is standalone deployability — that a module's own
requires is complete rather than satisfied by a sibling already in the database.
--force-all restores the old per-module behavior and is the only mode that asserts it.
(That distinction is not academic: constructive-db's -security companions were failing
exactly that check.)

minimalCoveringSet is exported and unit-tested for the covering, exclude-promotion, and
shared-dependency-promotion cases; selectMinimalModules is the thin PgpmPackage
adapter over it.

Link to Devin session: https://app.devin.ai/sessions/e283998fa441463a97df7614025b335a
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring