feat(runtime): durable Gate B handoff and PostgreSQL 18.4 authority

[DanielJD1216]

Summary

• complete Gate Gate B: durable receipt binding and truthful response handoff #294 durable format-2 receipt binding and truthful in-process handoff
• preserve immutable format-1 receipts and fail closed on incomplete format-2 authorization binding
• make exact PostgreSQL 18.4 the authoritative default while retaining PostgreSQL 16 through explicit compatibility selection
• add target-separated PostgreSQL 16 and 18.4 conformance evidence across Stories 1 through 5
• add physical PostgreSQL 16 to 18.4 upgrade and PostgreSQL 16 snapshot rollback rehearsal
• align package boundaries, CI, documentation, provenance, and dependency security gates

Verification

• npm run publish:readiness
• runtime tests: 201/201 passed
• targeted Gate B tests: 46/46 passed
• PostgreSQL 16 compatibility: 170/170 passed
• exact PostgreSQL 18.4 authority: 170/170 passed
• exact case and status parity: 170/170 passed
• physical PostgreSQL 16 to 18.4 upgrade: passed
• exact PostgreSQL 16 snapshot rollback: passed
• package dry run: 109 runtime files, all public scripts resolve to shipped files
• production dependency audit: 2 documented moderate, 0 high, 0 critical

Provenance

• commit: 6e8a19490391147f0bbb756afef0deed410f9964
• committed-source digest: 3c83e53bbd74850569373c4a50b419ada1d0067ce563599b23266c6dcaa5d29a
• package-lock SHA-256: b24cef9384c5b91f2c38fc3e8c399255d7e93fb7bed41bed92146d764e382160

Operational boundary

• no production listener is activated
• no private data, live connector, package publication, hosted operation, or production deployment is authorized by this change
• PostgreSQL 16 compatibility requires explicit caller selection

Closes #294