fix(gbrain): DSNs percent-encode the password; body reads retry; stdout drains

Three codex-adversarial findings in the provision port: (1) raw DB_PASS
interpolation — a reserved character (/ # ? % @) restructured the URI,
provisioning succeeded, and every consumer then failed to parse the DSN
(unusable billable orphan); now encodeURIComponent, round-trip pinned.
(2) await res.text() sat outside the transport try — a server that sent
headers then reset the stream was an uncaught exit 1 instead of a
retry-then-exit-8. (3) The bin entrypoint called process.exit() after
unawaited stdout writes, truncating piped JSON; exitCode lets writes
drain.

test/gbrain-supabase-provision.test.ts

@@ -403,6 +403,27 @@ describe('pooler-url', () => {
     expect(j.pooler_url).not.toContain('[PASSWORD]');
   });
 
+  test('percent-encodes reserved characters in DB_PASS (DSN stays parseable)', async () => {
+    // Raw interpolation of a password containing / # ? % @ changes URI
+    // structure: provisioning succeeds, every consumer then fails to parse
+    // the DSN — an unusable billable orphan.
+    mock = startMock({
+      [`GET /v1/projects/${REF}/config/database/pooler`]: () => jsonResp(POOLER_OK),
+    });
+    const r = await runCmd(['pooler-url', REF, '--json'], {
+      SUPABASE_ACCESS_TOKEN: 'sbp_test',
+      DB_PASS: 'p@ss/w#rd?100%',
+      SUPABASE_API_BASE: mock.url,
+    });
+    expect(r.status).toBe(0);
+    const j = JSON.parse(r.stdout);
+    expect(j.pooler_url).toBe(
+      `postgresql://postgres.${REF}:${encodeURIComponent('p@ss/w#rd?100%')}@aws-0-us-east-1.pooler.supabase.com:6543/postgres`
+    );
+    // The password segment must parse back out intact.
+    expect(decodeURIComponent(new URL(j.pooler_url).password)).toBe('p@ss/w#rd?100%');
+  });
+
   test('handles array response by preferring session pool_mode entry', async () => {
     mock = startMock({
       [`GET /v1/projects/${REF}/config/database/pooler`]: () =>