Land RPF-WP-0039 third apps-pg consumer source.

Admit vergabe_demo_company as the third declared consumer, track
the bounded provisioner and scoped controls, and refresh admission
occupancy to 3/3. Overflow remains apps-pg-2 before any fourth.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

helm/apps-pg-consumer-controls.sql

@@ -1,6 +1,8 @@
 -- Idempotent controls not expressible in the installed CNPG managed.roles CRD.
 -- Apply as the controlled apps-pg cluster administrator only after notifying
--- both consumers of the published limits in docs/s3-consumer-interfaces.md.
+-- bound consumers of the published limits in docs/s3-consumer-interfaces.md.
+-- The third consumer is scoped separately in helm/vergabe-demo-company-controls.sql;
+-- do not reuse this historical file to onboard it.
 ALTER ROLE vergabe SET statement_timeout = '15s';
 ALTER ROLE vergabe SET idle_in_transaction_session_timeout = '15s';
 ALTER ROLE coulomb_social SET statement_timeout = '15s';