Freeze lab-tested PostgreSQL plugin engine

Extract PostgreSQL, Podman runtime and systemd lifecycle adapters while preserving existing lifecycle and scoring behavior. Update RPM layout and add guarded operator-run lab harnesses.

Record successful manual stop/start, promotion, demotion and rewind-only rejoin with pinned installed hashes. The unfenced lab does not validate automatic failover, Pacemaker-managed transitions or divergent-data rewind.

Validation: 103 offline tests, original-function differential checks, checksum manifest and whitespace checks passed.

docs/testing.md

@@ -1,3 +1,6 @@
+> These production reports and source hashes describe the 488a167 freeze.
+> The current undeployed extraction is described in [plugin-engine.md](plugin-engine.md).
+
 # Validation and freeze-point evidence
 
 ## Reported production fencing and recovery test
@@ -69,7 +72,7 @@ whether any code changed since the test. Hash the running container's bootstrap;
 a host snapshot or image tag alone is not equivalent. Do not dump environment,
 secret files, or pgpass. Compare every node individually, preserving mismatches.
 
-## Repository freeze snapshot
+## Repository freeze snapshot (488a167)
 
 The exact repository code hashes appear below and in the reviewed checksum
 manifest. These identify the source freeze only, pending production comparison.
@@ -94,7 +97,7 @@ not yet confirmed identical to the production bootstrap.
 
 ## Non-production checks
 
-The source retains all 29 original lifecycle function bodies and original
+The frozen source retained all 29 original lifecycle function bodies and original
 parameter defaults. Added scoring changes public dispatch and metadata; it is
 not a claim of identical total behavior to the monolithic reference.