Implement PostgreSQL production store path

Add the PostgreSQL backend, migration and stopped-write transfer tools, lease-aware deployment manifests, tenancy declarations, and shared conformance coverage. Persist grouping mutations in durable stores and separate process liveness from database readiness.

tenancy.yaml

@@ -0,0 +1,78 @@
+# Canonical declaration: NetKingdom Tenancy Posture v0.1 draft-8.
+schema_version: "0.1"
+framework: netkingdom-tenancy-posture
+service: tenant-engine
+role: tenant-registry
+
+tenancy:
+  current: { I: 1, A: 0, E: 1, P: "n/a", R: 0, V: 0 }
+  implemented: { A: 3, E: 2, P: 1 }
+  target:  { I: 2, A: 3, E: 3, P: 1, R: 2, V: 1 }
+  reviewed: "2026-08-18"
+  review_due: "2027-02-17"
+  service_class: latency-critical
+  reason:
+    I: >-
+      Acting identity is supplied in request bodies; tenant-engine verifies no
+      inbound token. Canonical ownership of tenant records does not raise its
+      own inbound identity level.
+    A: >-
+      The running digest leaves GET tenant and role routes unprotected, so the
+      live minimum remains A0. Source now delegates every tenant/role read and
+      mutation to flex-auth before store access, implementing A3 without an
+      existence oracle; promotion and live endpoint evidence remain gated.
+    P: >-
+      Production still uses a dedicated SQLite PVC. It is a datastore, but it
+      is neither a shared database nor a PostgreSQL cluster described by P0-P4;
+      P1 is the accepted TEN-WP-0009 target.
+    R: >-
+      Tenant retirement is reversible and no hard-delete path exists; personal
+      fields therefore have no erasure position.
+    V: >-
+      The deployment has no exercised recovery objective or failover evidence.
+  gap:
+    I: "Bind actor and tenant to a verified inbound token."
+    A: "Authenticate and authorize every read path; then evidence endpoint denial."
+    E: >-
+      Child records are tenant-keyed, but E2 requires binding an authenticated
+      identity and adversarial evidence. Registry tables remain a named E3
+      exception because cross-tenant enumeration is their function.
+    P: "Complete TEN-WP-0009 and publish the P1 isolation evidence."
+    R: >-
+      docs/data-retention-policy.md now declares indefinite primary-record
+      retention and a 30-day copy horizon honestly. R2 still requires an
+      implemented and evidenced personal-field erasure/expiry workflow.
+    V: "Exercise restart recovery for tenant-engine and its critical path."
+  paths:
+    A:
+      mutations: 3
+      tenant_reads: 0
+      live_role_reads: 0
+    E:
+      tenant_keyed_children: 2
+      tenant_registry: 1
+  placement_exceptions: []
+
+provider:
+  capability: tenant.registry
+  axes:
+    I:
+      available: 2
+      maximum: 3
+      conditions:
+        - "Consumers verify canonical tenant identifiers on their own inbound calls."
+        - "I3 consumers wire the live role lookup on high-stakes paths."
+      evidence:
+        - "net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md"
+
+evidence:
+  E1:
+    - "src/tenant_engine/domain.py"
+    - "tests/test_store.py"
+  implemented_A3:
+    - "src/tenant_engine/app.py"
+    - "tests/test_api_reads.py"
+  implemented_P1:
+    - "src/tenant_engine/postgres_store.py"
+    - "tests/postgres_backend.py"
+    - "src/tenant_engine/transfer.py"