feat(database): add domain-separation enforcement gates (OMN-15361)

[jonahgabriel]

Summary

Implements the Phase 9 enforcement-gate lane from the one-application-database domain-separation plan for OMN-15361.

• Adds fail-closed SQL lexical and catalog-source enforcement for governed application-domain objects.
• Enforces source/tenant authority transitively across relations, routines, indexes, triggers, and views.
• Adds a frozen typed semantic registry with exact one-to-one coverage for all 60 mapped nodes.
• Adds focused unit, contract, and live PostgreSQL controls, plus a hosted rebuilt-Docker workflow gate.

Stack

This is a stacked draft PR targeting omnibase_infra#2548:

• Base PR: feat(runtime): type database ownership wiring (OMN-15418) #2548
• Base branch: jonah/omn-15418-p0-replace-raw-db_io-loading-with-typed-declarations-and
• Verified base head: 7228ce0
• Head commit: 926bd56

Do not merge before the base stack and required evidence gates are satisfied.

Verification

• Independent terminal review: 0 P0 / 0 P1.
• Focused local enforcement suite: 410 passed, 1 honest Docker skip.
• PostgreSQL 16.14 disposable-cluster proof: 46/46 red controls passed.
• Semantic registry contract: 19/19 tests and all 60 nodes mapped exactly once.
• Governed .200 pre-push: 22,829 passed, 36 skipped in 445.13 seconds.
• Ruff, strict mypy, architecture validation, diff checks, commit hooks, and pre-push hooks passed.
• Exact 53-file manifest SHA-256: 08935feccbb6adbc0e5901000b0ae3781705601c84464ad4b41fcb27b01e3956.

Hosted gates

Local and .200 Docker execution was unavailable, so the hosted Application Database Domain Enforcement (OMN-15361) rebuilt-Docker job is mandatory. The workflow uses Docker build semantics so source changes are included.

Deploy-scope pre-push emitted NOTICE_COMPANION_UNMERGED. Receipt/OCC and deploy gates must resolve through central onex_change_control evidence; no bypass token or local receipt substitute was added.

Runtime impact

No live database, security policy, deploy, restart, cutover, .201, OCC, or merge mutation was performed.

Stacked-Parent: #2548

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b50a772f-8cc7-484a-b1c7-7668f00a7663

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}