fix(postgres): isolate Amiary database roles and guarded backup jobs

[kaanyagci]

Changes

• Add isolated Amiary roles, bootstrap and scoped backup/restore helpers.
• Keep the existing production PostgreSQL runtime and shared deployment workflow. PG18 preflight material documents a separate upgrade operation.
• Keep existing Runtrace helpers intact; expose Amiary helpers as run-amiary-shared-backup.sh and verify-amiary-shared-restore.sh without activating a global scheduled job.
• Preserve existing Amiary login passwords during reconciliation and order Amiary HBA restrictions before broad rules.
• Require exact dedicated empty restore databases, validated identifiers and TLS verify-full before restoring any data.
• Add regression coverage and executable entrypoints.

Native GitHub stack

Native stack #60; builds on #58, #59 and #5.

Validation

Full current shared run-ci.sh passed locally. Real TLS restoration of all five fixture databases, ownership/ACL/RLS checks, bootstrap and backup tests passed. Password retention and unsafe restore target regressions failed before the fixes and passed after. Latest Amiary and Fashion GitHub CI passed; consult current checks for the general CI run. Production activation and any PostgreSQL major upgrade have not occurred.

Release status

Reviewed and repaired as part of the shared-service PR sweep. This PR remains unmerged pending GitHub repository gates. No branch-protection bypass or production deployment is included in this review.

Review corrections and validation

Fixed inherited shell guards so invalid backup settings and existing paths fail explicitly. The plaintext-artifact test now fails on a match. ShellCheck, backup contracts, and both safety suites pass.