Land RPF-WP-0039 third apps-pg consumer source.

Admit vergabe_demo_company as the third declared consumer, track
the bounded provisioner and scoped controls, and refresh admission
occupancy to 3/3. Overflow remains apps-pg-2 before any fourth.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

helm/vergabe-demo-company-role.yaml

@@ -0,0 +1,11 @@
+# Exact managed.roles entry; append through the bounded owner helper.
+name: vergabe_demo_company
+ensure: present
+login: true
+inherit: false
+superuser: false
+createdb: false
+createrole: false
+connectionLimit: 20
+passwordSecret:
+  name: vergabe-demo-company-credentials