feat(projections): add transactional PostgreSQL projections

[jwilger]

Summary

• add a lossless global PostgreSQL delivery frontier with deterministic backfill and explicit source failures
• add transactional projectors whose read-model effects and durable progress commit in the same leader-owned SQLx transaction
• add typed retry/skip/stop/fatal, commit-indeterminate recovery, batch/continuous execution, and coordinated reset/replay
• add reusable public backend contracts, fault-injection coverage, documentation, and the 2.1.0 release-readiness matrix

Architecture and compatibility

• Implements accepted ADR-0050 and ADR-0051.
• Keeps SQLx-free delivery vocabulary in eventcore-types; PostgreSQL execution remains in eventcore-postgres and is re-exported under eventcore::postgres::projections.
• Preserves the released legacy projector, reader, checkpoint, coordinator, and migration APIs. The new API is additive and targets lockstep version 2.1.0.
• Supports separate event-source and read-model pools, including distinct databases.
• Does not add shadow-generation rebuilding or Foundry-specific domain behavior.

Migration and operations

• Uses a projection-component migration ledger separate from _sqlx_migrations.
• Initial delivery migration takes ACCESS EXCLUSIVE on the events table while it backfills stable positions and installs the transactional frontier trigger; operators must schedule writer downtime.
• Projector source/selection identities are durable compatibility boundaries.
• Advisory leadership is session-affine and the owning connection is close_on_drop.
• Commit errors are reported as indeterminate; operators recover by starting a fresh run that reloads durable progress.
• Reset/replay requires coordinated downtime and intentionally has no shadow-generation handoff.

Behavioral contracts

The reusable suite covers all 16 requested contracts: atomic effect/progress commit; both rollback directions; true interrupted-commit recovery; restart; redelivery suppression; commit-order-safe delivery; malformed input; leader exclusion; fence loss; multi-page batch drain; continuous catch-up; bounded retry exhaustion; explicit skip; reset/replay reconstruction; and after-commit ordering.

Additional regressions cover full persisted-envelope fidelity, event-type-aware application decoding, exact failure context, zero-batch rejection, source/selection identity validation, retry backoff arithmetic, and cancellation-safe fixture/proxy ownership.

Local evidence

• cargo nextest run --workspace --all-features: 500/500 passed, 0 skipped
• cargo test --doc --workspace --all-features: 35 passed, 18 ignored
• cargo build --workspace --all-features: passed
• cargo clippy --all-targets --all-features -- -D warnings: passed
• standalone eventcore-postgres library check and warning-denied rustdoc: passed
• focused PostgreSQL projection binaries: 110/110 passed
• scoped mutation testing: 92 outcomes = 31 caught + 61 unviable, 0 missed/survivors/timeouts
• 32/32 branch commits are signed and use Conventional Commit subjects
• final database cleanup: 0 other client sessions and 0 test-owned schemas
• seven independent pre-PR reviews (architecture, transaction, concurrency/fencing, recovery/fault truthfulness, API/semver, test quality, and documentation): approved with 0 unresolved findings

Full evidence and the 10-finding/16-contract matrices are in the release-readiness report.

Tracking and release boundary

• Tiber task: 20260909-zscu-deliver-transactional-postgresql-projections-through-reviewed-pr
• Foundry should consume exact version =2.1.0 with feature postgres only after merge and separately approved publication.
• No crate publication is authorized by this PR.
• Merge remains owner-controlled and is not authorized by opening this PR.

[jwilger]

Final delivery audit for signed head 83cae41048e3cb59ae70ae1f56ca38f7c81c414e:

• replacement CI run 34503197038 completed successfully
• all 8 reported checks are green: Detect Changes, Format, Test, Clippy, Experimental Model Feature Isolation, Security Audit, Mutation, and CI Gate
• GitHub reports the PR mergeable with a clean merge state; there are no unresolved comments
• seven independent Codex review scopes (architecture, transaction ownership, concurrency/fencing, recovery/fault truthfulness, API/semver, test quality, and documentation) approved with 0 Critical, 0 Important, and 0 Minor findings
• local evidence: 500/500 all-feature workspace tests, 110/110 focused PostgreSQL projection tests, and 92 scoped mutation outcomes with 0 missed/surviving mutants and 0 timeouts
• full 10-finding and 16-contract evidence: release-readiness report

The PR is ready for owner review/merge. Opening and validating this PR does not authorize merge or crate publication. Publication remains separately approval-gated.