Finish RPF-WP-0018; RPF-WP-0019 repository-complete

RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding
was adopted upstream and its canonical form is the provider: block in
tenancy.yaml; adaptive-pricing declined the standing co-signature and
supplied typed tier minima instead, recorded in ADR-0002. Three corrections
against our own output are recorded in the documents rather than edited
away.

RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as
overflow, enforced by make apps-pg-verify-capacity). T01/T02 are
repository-complete: backup target, retention, per-consumer connection
limits, role timeouts and Burstable resources are declared in source and
published in s3-consumer-interfaces 1.1.0 before rollout. They stay in
progress because no live application, backup success or restore proof
exists, and declared configuration is not a section 13 artifact. T04 waits
on that window.

apps-pg R reason corrected to say the target is declared-not-applied rather
than absent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

helm/apps-pg-consumer-controls.sql

@@ -0,0 +1,7 @@
+-- Idempotent controls not expressible in the installed CNPG managed.roles CRD.
+-- Apply as the controlled apps-pg cluster administrator only after notifying
+-- both consumers of the published limits in docs/s3-consumer-interfaces.md.
+ALTER ROLE vergabe SET statement_timeout = '15s';
+ALTER ROLE vergabe SET idle_in_transaction_session_timeout = '15s';
+ALTER ROLE coulomb_social SET statement_timeout = '15s';
+ALTER ROLE coulomb_social SET idle_in_transaction_session_timeout = '15s';