Freeze lab-tested PostgreSQL plugin engine

Extract PostgreSQL, Podman runtime and systemd lifecycle adapters while preserving existing lifecycle and scoring behavior. Update RPM layout and add guarded operator-run lab harnesses.

Record successful manual stop/start, promotion, demotion and rewind-only rejoin with pinned installed hashes. The unfenced lab does not validate automatic failover, Pacemaker-managed transitions or divergent-data rewind.

Validation: 103 offline tests, original-function differential checks, checksum manifest and whitespace checks passed.

refactored/managed-container.d/runtimes/podman.sh

@@ -0,0 +1,24 @@
+# Runtime adapter API 1. The existing rootless privilege boundary is unchanged.
+MC_RUNTIME_API=1
+
+mc_runtime_exec()
+{
+    as_service_user podman exec "$@"
+}
+
+mc_runtime_exec_bounded()
+{
+    local duration="$1"
+    shift
+    as_service_user timeout --kill-after=1s "${duration}" podman exec "$@"
+}
+
+mc_runtime_inspect()
+{
+    as_service_user podman inspect "$@"
+}
+
+mc_runtime_info()
+{
+    as_service_user podman info "$@"
+}