Implement PostgreSQL production store path

Add the PostgreSQL backend, migration and stopped-write transfer tools, lease-aware deployment manifests, tenancy declarations, and shared conformance coverage. Persist grouping mutations in durable stores and separate process liveness from database readiness.

deploy/tenant-engine-migration.yaml

@@ -0,0 +1,86 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: tenant-engine-schema-migration
+  namespace: tenant-engine
+  labels:
+    app.kubernetes.io/name: tenant-engine
+    app.kubernetes.io/component: migration
+spec:
+  backoffLimit: 2
+  ttlSecondsAfterFinished: 86400
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tenant-engine-migration
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: Never
+      securityContext:
+        fsGroup: 10001
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: migrate
+        image: forgejo.coulomb.social/coulomb/tenant-engine@sha256:44ca65f3cdd5967b0124e16b6aba10bf1ac2747e1dde96cbef3dd11ae7cc9574
+        args:
+        - tenant-engine-migrate
+        - --url-file
+        - /var/run/secrets/postgres-migration/url
+        env:
+        - name: TENANT_ENGINE_MIGRATION_DATABASE_URL_FILE
+          value: /var/run/secrets/postgres-migration/url
+        resources:
+          limits:
+            cpu: 500m
+            memory: 256Mi
+          requests:
+            cpu: 25m
+            memory: 48Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - mountPath: /var/run/secrets/postgres-migration
+          name: postgres-migration
+          readOnly: true
+      volumes:
+      - name: postgres-migration
+        secret:
+          defaultMode: 0440
+          secretName: tenant-engine-postgres-migration
+          items:
+          - key: url
+            path: url
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: tenant-engine-schema-migration
+  namespace: tenant-engine
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: tenant-engine-migration
+  policyTypes: [Egress]
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: platform-pg
+    ports:
+    - {port: 5432, protocol: TCP}
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - {port: 53, protocol: UDP}
+    - {port: 53, protocol: TCP}