Runs pgTAP tests against an ephemeral shadow database built from
migrations, keeping the local dev database untouched. Reuses the
existing CreateShadowDatabase/MigrateShadowDatabase machinery from
db diff. Uses host networking so pg_prove can reach the shadow
container via 127.0.0.1:<shadow_port>.

Document the --use-shadow-db flag in the CLI man page with usage details, shadow port config, and CI guidance. Add a shadow-db example to examples.yaml and fix the stale shadow_port comment in testdata/config.toml to match the production template.

Add three tests exercising the useShadowDb=true code path in Run(): happy path with full shadow DB lifecycle (create, health check, migrate, pg_prove), error on shadow creation failure, and error on shadow migration failure. Raises test.go coverage from 15% to 85%.