[F059] fix DB-integration test auth + retype self-heal root code→planning

conftest test-DB defaults matched the project's own running postgres
(roboco/roboco @ localhost:15432, the docker-compose roboco-postgres
service with CREATEDB) instead of the OS user on localhost:5432 which has
no such role — every db_session test failed with InvalidPasswordError
instead of running.

Once the DB connection worked, the self-heal origination DB test went RED
with MAIN_PM_NO_CODE: the self-heal root was task_type=CODE owned by
main_pm, the combo the main_pm_cannot_own_code guard rejects. The Main PM
coordinates the fix (delegates the code work to a cell dev); it has no
code verb. Retyped CODE→PLANNING and rewrote description/AC to
coordination-level.

tests/unit/runtime/test_self_heal_ceo_gate.py

@@ -179,7 +179,10 @@ async def test_originate_opens_task_held_for_ceo(
     assert req.confirmed_by_human is False  # held for the CEO — the F059 fix
     assert req.status == TaskStatus.PENDING
     assert req.source == SELF_HEAL_SOURCE
-    assert req.task_type == TaskType.CODE
+    # A Main-PM-owned coordination root (not code — the Main PM delegates the
+    # fix to a cell dev). `code` + `main_pm` is rejected by the
+    # main_pm_cannot_own_code guard, so the self-heal root must be `planning`.
+    assert req.task_type == TaskType.PLANNING
 
 
 # ---------------------------------------------------------------------------