fix(config): resolve cloud-check compares checked_at at nanosecond precision against microsecond DB timestamps (main integration test red) #1251

Main's Integration Tests job fails at a14dc8f2 (run 39878015423):

--- FAIL: TestPostgresStoreDB_ResolveStaleRIExchange_ValidatesCloudCheck
    --- FAIL: .../checked_at_the_change
        Expected error with "invalid ri exchange resolve request" in chain but got nil.

The other subtests then fail too: the one bad resolve releases the hold, so later cases replay or see failed instead of processing.

Cause. checkRIExchangeCloudCheck compares the operator's checked_at, a Go time.Time with nanoseconds, against updated_at read back from Postgres, which keeps only microseconds. A check stamped at the row's own last-change instant therefore looks a few hundred nanoseconds after it. The resolve is accepted when it should be refused as "checked_at must be after the exchange's last change". validateLadderUnverifiedFail compares checked_at against lastChange the same way.

Why main only notices now. In #1109 (#692) the test skipped unless RI_EXCHANGE_TEST_DATABASE_URL was set. #1165 moved it onto the shared testcontainers Postgres, so it now runs in CI. The local verification for #1109's merge ran go test -short without the integration tag, so it didn't catch this either.

Real-world impact: low. The API parses checked_at as RFC 3339, usually at whole seconds, so it's a sub-microsecond window. But main's CI is red.

Refs #692