feat(runtime): harden PostgreSQL status posture

[DanielJD1216]

Summary

• harden the existing read-only source-wire-local database status boundary instead of adding a duplicate operations command
• report bounded PostgreSQL authority, recovery, inspection, and schema posture through source-wire.local-database-status.v1
• classify exact PostgreSQL 18.4 as authoritative and PostgreSQL 16.x only through explicit compatibility selection
• fail closed for unsupported versions, standby recovery, invalid read-only inspection, invalid selector input, unavailable databases, and invalid runtime authority
• short-circuit unsupported, standby, and invalid read-only posture before migration metadata inspection
• bound every status rollback to 250 ms and destroy uncertain PostgreSQL clients on timeout, rejection, or synchronous cleanup failure with client.release(error)
• preserve redacted output, bounded queries, zero migration application, and mutationApplied: false
• add Story 1 case S6-DB-05 and align the existing Story 6.5 guide without claiming production readiness

TDD evidence

Observed RED before GREEN for:

1. exact PostgreSQL 18.4 authority classification
2. explicit-only PostgreSQL 16 compatibility
3. standby recovery refusal
4. non-read-only inspection refusal
5. invalid compatibility selection before connection
6. bounded status rendering and redaction
7. live PostgreSQL status fields in Story 1 conformance
8. posture short-circuit before migration metadata
9. synchronous rollback failure destroys the client
10. stalled successful-path rollback times out and destroys the client
11. PostgreSQL 16 local export receives explicit compatibility selection, while malformed export selection fails before connection or destination creation

Verification

• focused PostgreSQL status tests, 9/9 passed
• npm run alpha1:test, 213/213 tests passed
• PostgreSQL 16.14 explicit compatibility, Story 1 43/43 cases passed
• exact PostgreSQL 18.4 authority, Story 1 43/43 cases passed
• PostgreSQL 16.14 Story 4 local export and recovery, 27/27 cases passed
• PostgreSQL 16.14 baseline Stories 1 through 5, passed
• exact PostgreSQL 18.4 Story 4 local export and recovery, 27/27 cases passed
• npm test, passed
• npm run alpha1:ci-workflow-smoke, passed
• npm run local-runtime:candidate-smoke, passed
• npm run local-runtime:security-gate, passed with the repository's existing documented nested MCP advisory disposition
• npm run docs:links, passed
• npm run docs:anchors, passed
• npm run safety:scan, zero findings
• npm run claims:scan, zero findings
• npm run publish:readiness, passed without publishing
• npm run readiness:report, reports Story 1 at 43 cases
• npm audit --omit=dev --audit-level=high, two known moderate transitive advisories and zero high or critical findings
• git diff --check, passed
• added-line static security scan, zero findings
• authoritative final independent diff review, passed with zero security concerns and zero logic errors on SHA-256 a53fe995ea7116a38fd353ced710898f675290ce3066ddadd5b6e5fbeafe821d
• authoritative PostgreSQL 16 export compatibility follow-up review, passed with zero concerns on SHA-256 4225403eecd500fbbaf8fb28e042218134683cf76d7538fcb3fe980161a1b92e

Boundaries

This does not add or claim:

• backup or restore health
• RPO or RTO
• capacity safety or alert delivery
• managed PostgreSQL or production support
• public listener, hosting, deployment, live provider, or real-data authorization
• package publication or release

Issue #296 remains open for custody identities, independent journal, physical backup and PITR, isolated restore drills, restart handling, capacity lifecycle, observability, alerts, and rollback controls.

Closes no issue. Advances #296.

[DanielJD1216]

Exact-head CI recovery

Head: 21280eca5b410b466921aa8a121fd5d60c3a61cf

Root cause: local export performs a read-only database status inspection before exporting, but it did not forward the explicitly selected PostgreSQL 16 compatibility major. The first Story 4 local export therefore failed closed on PostgreSQL 16 even though the standalone database status command handled the selector correctly.

Fix:

• moved the existing fail-closed selector parser into the shared local database boundary;
• reused it from both database status and local export;
• forwarded only explicit compatibility major 16 into export's read-only status inspection;
• added regression coverage proving unsupported 18 and malformed 16x return bounded environment_invalid before database access or destination creation.

Verified:

• PostgreSQL 16 Story 4: 27/27 passed;
• PostgreSQL 16 baseline Stories 1 through 5: passed;
• PostgreSQL 16 candidate conformance: passed;
• PostgreSQL 18.4 Story 4: 27/27 passed;
• Alpha runtime tests: 213/213 passed;
• definitive incremental review passed with zero concerns on SHA-256 4225403eecd500fbbaf8fb28e042218134683cf76d7538fcb3fe980161a1b92e;
• both exact-head GitHub workflow runs passed PostgreSQL 16, PostgreSQL 18.4, and package checks.

Issue #296 remains open for the larger Gate B operations work. No deployment, publication, listener activation, hosted operation, private-data use, production setup test, or merge is authorized by this receipt.