fix(ops): complete safe PostgreSQL production cutover

[azurras]

Summary

Complete the Windows PostgreSQL cutover corrections discovered while validating the real failed production attempt.

• Accept exactly one command-specific Java evidence record amid benign driver logs; reject malformed, conflicting, or duplicate records.
• Preserve JSON timestamp strings so journal checksums survive disk round trips (PowerShell 7.5+).
• Serialize writer-lock expiry as UTC ISO-8601 accepted by Java Instant.parse.
• Validate the candidate with the database-enforced read-only viewer role. Suppress five mutating startup handlers only for deploy-smoke, retaining normal production dispatch.
• After durable authority intent, switch the website dependency to PostgreSQL and disable MongoDB startup.
• Advance the persistent writer-start release marker, including resume, and import its owning module explicitly.

Validation

• Full Windows ops Pester suite: 795 passed, 0 failed, 28 skipped.
• Focused startup/handler Java suites: 79 passed, 0 failed.
• Regression tests observed failing before the fixes: journal round trip, ISO writer lease, startup profile dispatch (including legacy VIN cleanup).
• Independent final scoped review approved; git diff --check passed.
• Read-only elevated production inspection confirmed ROLLED_BACK, absent authority sidecar, matching catalog digest, and five driver log lines plus one valid snapshot record. No new authority transfer yet.

Operational follow-through

The user already approved up to 30 minutes downtime. Preserve prior failed-attempt evidence and pause automatic deployment before cutover. Ordinary deployment still requires a separate PostgreSQL-aware candidate/backup path before automatic deployment can be reenabled. MongoDB retirement is gated by the recorded 14-day post-authority soak and restore proof; retain the final Mongo archive 90 days.