refactor(control-plane): split the PostgreSQL adapter into capability repositories (audit F-08)

The 1,914-line postgres.py monolith becomes seven bounded modules with
method bodies moved verbatim: postgres_schema (DDL + the versioned
migration ledger), postgres_base (bounded pool, migration runner,
pool-stats collector, _replace_record_set, _masked_dsn),
postgres_webhook, postgres_alert, postgres_outbox_replay,
postgres_usage_audit — each repository class implements exactly its
capability port — and postgres.py stays the assembly point and public
import surface. __init__ and resolve_postgres_store_from_env stay on the
facade so the constructor's optional-dependency guards keep reading
postgres.psycopg / postgres.psycopg_pool, the seam the selection tests
stub.

Path-pinned references move with the code: the S608 per-file-ignore and
the security-tooling S608 count (3, all in _replace_record_set) now point
at postgres_base.py, and the enqueue-lease static contract reads
postgres_webhook.py.

Verified: full mypy over src clean (152 files); ruff check/format clean;
store/capabilities/lease-contract/security-policy/helm suites 111 passed
(38 live-PG skips without a DSN, as before).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JuliaEdom

pyproject.toml

@@ -231,9 +231,10 @@ ignore = ["S101", "S311"]
 "src/serving/api/routers/lineage.py" = [
     "S608",
 ]
-# Interpolations are internal literals only (a lease-expiry SQL fragment,
-# optional filter clauses, table-name constants); all values bind via %s.
-"src/serving/control_plane/postgres.py" = [
+# Interpolations are internal literals only (the _replace_record_set
+# table-name constant — audit F-08 moved it here from postgres.py); all
+# values bind via %s.
+"src/serving/control_plane/postgres_base.py" = [
     "S608",
 ]
 "src/serving/api/routers/slo.py" = [