Bound /readyz so kubelet probes cannot hang the Service

/readyz walked the hash chain and opened pooled connections with no
libpq connect_timeout, so a 2s kubelet probe never saw a response and
the pod stayed unready. Informed Decision accept is blocked on that.

Probe health() only, under a 1.5s budget, publish last-known
tamper_evidence, and fail TCP handshake in 1s. Integrity stays on
/v1/integrity.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082

tests/test_backend_conformance.py

@@ -359,6 +359,32 @@ def test_connects_from_a_brokered_libpq_environment(monkeypatch):
         backend.close()
 
 
+def test_postgres_connections_set_a_connect_timeout(monkeypatch):
+    """A hung TCP handshake must not hold /readyz past the kubelet budget."""
+    try:
+        from audit_core.postgres_backend import PostgresAuditBackend
+    except ImportError:
+        pytest.skip("psycopg is not installed")
+
+    captured: dict = {}
+
+    class FakePool:
+        def __init__(self, dsn, **kwargs):
+            captured["dsn"] = dsn
+            captured.update(kwargs)
+
+        def close(self):
+            return None
+
+    monkeypatch.setattr("audit_core.postgres_backend.ConnectionPool", FakePool)
+    PostgresAuditBackend("postgresql://example/audit", migrate=False)
+    kwargs = captured["kwargs"]
+    if callable(kwargs):
+        kwargs = kwargs()
+    assert int(kwargs["connect_timeout"]) == 1
+    assert "statement_timeout" in kwargs["options"]
+
+
 def test_missing_connection_information_is_a_clear_error(monkeypatch):
     for var in ("AUDIT_CORE_DATABASE_URL", "PGHOST", "PGUSER"):
         monkeypatch.delenv(var, raising=False)