feat(storage): add PostgreSQL multi-replica store

[aantenore]

What changed

• add an optional pausemesh/postgres adapter with an injected, host-owned pool
• add explicit checksum-validated migration and transactional stream-head CAS for multiple replicas
• add bounded replay validation, append-only database guards, and fail-closed readiness
• split /healthz liveness from host-owned /readyz dependency checks
• ship a PostgreSQL 17 integration job, fake-pool adversarial tests, clean-consumer package smoke, ADR, and operations runbook
• release the isolated capability as 0.3.0-alpha.1

Why

SQLite/WAL handles local restart recovery, but callbacks can reach another application replica. The existing atomic EventStore port is the right extension point: shared durability belongs below the continuation primitive, without adding orchestration, routing, agent loops, or database lifecycle to the core.

Impact and boundaries

The root package remains free of a PostgreSQL client dependency and the CLI remains SQLite-only. Deployment code owns credentials, TLS, timeouts, pool sizing, roles, migrations, and shutdown. Readiness verifies the migration ledger, required objects, active trigger bindings, and access; the runtime role must remain DDL-free because this is not a full database attestation system.

Verification

• pnpm check — 193 tests passed, 1 opt-in integration skipped in ordinary coverage
• real PostgreSQL 17 integration against an ephemeral container
• package tarball installed and imported from a clean consumer
• git diff --check
• independent storage review with no remaining P0/P1 findings