feat(database): generate application ACL matrix (OMN-15355)

[jonahgabriel]

Summary

• Adds typed, contract-driven principal inventories, ACL policies, topology inputs, and object evidence for the one-application-database separation plan.
• Adds a deterministic generator that resolves immutable Git source pins and emits a candidate ACL matrix covering database CONNECT, role membership, schemas, tables/views, sequences, exact-signature routines, and default privileges.
• Adds an isolated PostgreSQL 16 proof harness and hosted workflow. The candidate is deliberately fail-closed (BLOCKED) while production evidence is incomplete; no production SQL, live database mutation, RLS, cutover, deploy, or restart is included.

Stack

Stacked-Parent: #2548

• Base: feat(runtime): type database ownership wiring (OMN-15418) #2548 (OMN-15418 typed database topology/ownership wiring)
• This PR: OMN-15355 generated ACL matrix and PostgreSQL 16 proof
• Merge only after the base PR lands, then retarget to dev.

Evidence

• Candidate matrix: 112 objects, 580 ACL rows, 60 default ACL rows, 332 blockers, 34 scaffold blockers; full/scaffold outcomes are both BLOCKED as intended.
• Determinism: repeated generation is byte-identical; the observed pre-change ACL artifact is byte-identical across proof runs.
• Fresh native PostgreSQL 16.14 cold proof: acl_status=PASS postgres_major=16 objects=21 rows=200 defaults=96.
• Focused ACL suite: 51 passed, 1 skipped (Docker-only skip).
• Validation subtree plus ACL CI: 1165 passed.
• Designated .200 pre-push gate: mypy PASS, architecture PASS, full governed unit suite 22428 passed, 40 skipped.
• Independent review: cumulative feature review PASS; type-gate delta PASS with cumulative HEAD confirmed; final protocol-registry delta PASS.

Source pins

The proof lock records exact repository revisions and SHA-256 digests for topology, typed ownership loading, Kubernetes topology projection, relation inventory, service ownership manifests, and the sanitized legacy fixture. Generation rejects missing or drifted sources.

Safety / rollout

• Candidate evidence only; production SQL is absent whenever any blocker remains.
• No live database or runtime changes were performed.
• Hosted Docker/PostgreSQL 16 CI remains the authoritative container proof.
• Deployment/receipt evidence and cutover are separate downstream gates.

Ticket: OMN-15355

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 075f3ee1-c212-4ea8-b300-a22ab71c3011

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}