Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook

VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.

tests/test_backend_conformance.py

@@ -312,7 +312,10 @@ def test_connects_from_a_brokered_libpq_environment(monkeypatch):
 def test_missing_connection_information_is_a_clear_error(monkeypatch):
     for var in ("AUDIT_CORE_DATABASE_URL", "PGHOST", "PGUSER"):
         monkeypatch.delenv(var, raising=False)
-    from audit_core.postgres_backend import PostgresAuditBackend
+    try:
+        from audit_core.postgres_backend import PostgresAuditBackend
+    except ImportError:
+        pytest.skip("psycopg is not installed")
 
     with pytest.raises(ValueError, match="no connection information"):
         PostgresAuditBackend()