feat(playbook): prove the Gitaly Cluster survives losing a primary

[NWarila]

What

R3.1 ran R2's whole proof through Praefect but did not show that Praefect works as declared, or that the cluster
survives losing a Gitaly node. This adds both checks to the opt-in proof, after the Rails failover.

1. Praefect's database. Connecting as Praefect's own role, the proof requires every backend of that role on
   TLSv1.3, and a LISTEN connection from each of the three Praefect nodes. Each node opens two: the read cache and
   the repository locks. The master user's read now requires three SCRAM verifiers: GitLab's, Praefect's and its
   own. The connection counts, and the database logs' size and read time, are reported.
2. Losing the primary. The steps, in order:
   1. Wait for three replicas that are assigned, fully up to date, healthy and valid primaries.
   2. Dataloss must find every repository fully available.
   3. Read the primary from praefect metadata and stop its Gitaly.
   4. Wait for the primary to read Healthy: false.
   5. Push over HTTP. The push must succeed and HTTP must serve it. Praefect must name a new primary, with the
      stopped replica "behind by" and the other two current.
   6. Gitaly restarts in an always section judged by a named cleanup assert.
   7. Wait until the rejoined replica is reconciled, so all three are valid primaries again.
   8. Dataloss must find every repository fully available again.
   9. gitlab:praefect:replicas must show three equal checksums.

Every expected line is the 19.4.1 source's own format. The parsers were checked against real metadata,
dataloss and rake output, captured from the held stack of run 37119822220:

• Primary: "tcnaw-gitaly01";
• three replicas, each fully up to date, Healthy: true and Valid Primary: true;
• both dataloss endings, with their two-space indent;
• three equal checksums under a (primary) header.

Review

• Audits: four domain audits, then a confirmation round; zero open findings.
• Gates: gate r1 (notes c, d, e, i), and Revision 3 with gate r3 (A–D).
• Gate r3's source check: dataloss runs metadata's query plus a valid_primaries clause. Both metadata waits now
  require Valid Primary: true, so the read after them cannot lag.

Proof

Local:

• 47 parser cases, from the extracted expressions and the real output formats;
• an end-to-end stub flow: green; no-election and push-failure cases each fail by name and still restart Gitaly;
  0 secrets in any log;
• the trimmed SQL run on PostgreSQL 17;
• the conditional scan: 437 items, all strings;
• lint, syntax-check and actionlint.

Budget: the proof step stays at 30 minutes. That covers the 11 minutes measured through Praefect (run 37119822220)
plus an estimated 3–5 for these checks; about 26.5 minutes is the realistic worst case. The first green run's measured
duration is recorded on this PR. Above 20 minutes, a follow-up raises the step to 45.

Live: this merge is followed by a 240-minute hold dispatch. That run is the cluster proof's first live run, and the
region's acceptance run.