Finish RPF-WP-0018; RPF-WP-0019 repository-complete

RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding
was adopted upstream and its canonical form is the provider: block in
tenancy.yaml; adaptive-pricing declined the standing co-signature and
supplied typed tier minima instead, recorded in ADR-0002. Three corrections
against our own output are recorded in the documents rather than edited
away.

RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as
overflow, enforced by make apps-pg-verify-capacity). T01/T02 are
repository-complete: backup target, retention, per-consumer connection
limits, role timeouts and Burstable resources are declared in source and
published in s3-consumer-interfaces 1.1.0 before rollout. They stay in
progress because no live application, backup success or restore proof
exists, and declared configuration is not a section 13 artifact. T04 waits
on that window.

apps-pg R reason corrected to say the target is declared-not-applied rather
than absent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

helm/apps-pg-2-cluster.yaml

@@ -0,0 +1,45 @@
+# Provisionable overflow cell for the apps-pg three-consumer ceiling.
+# Do not apply while empty; see docs/apps-pg.md.
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: apps-pg-2
+  namespace: databases
+  labels:
+    app.kubernetes.io/name: apps-pg-2
+    app.kubernetes.io/component: database
+    app.kubernetes.io/managed-by: manual
+    railiance.io/layer: s3-platform
+    railiance.io/role: shared-apps-database
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  resources:
+    requests: {cpu: 100m, memory: 256Mi}
+    limits: {cpu: "1", memory: 1Gi}
+  storage:
+    size: 10Gi
+  bootstrap:
+    initdb:
+      database: apps_meta
+      owner: apps_admin
+      secret:
+        name: apps-pg-2-credentials
+  postgresql:
+    parameters:
+      max_connections: "100"
+      log_connections: "on"
+      log_disconnections: "on"
+      log_lock_waits: "on"
+      log_min_duration_statement: "1000"
+      track_io_timing: "on"
+  backup:
+    retentionPolicy: "30d"
+    barmanObjectStore:
+      destinationPath: s3://railiance-platform-pg-backup/apps-pg-2/
+      endpointURL: https://s3.nl-ams.scw.cloud
+      s3Credentials:
+        accessKeyId: {name: platform-pg-backup-s3, key: ACCESS_KEY_ID}
+        secretAccessKey: {name: platform-pg-backup-s3, key: ACCESS_SECRET_KEY}
+      wal: {compression: gzip, maxParallel: 2}
+      data: {compression: gzip, jobs: 2}