feat(security): attest live Brio database controls

[kaanyagci]

Summary

• emit a deterministic, credential-free PostgreSQL control receipt from fixed local probes
• validate SSL and SCRAM settings, the exact Brio pg_hba allow/reject rules, verify-full certificate identity, plaintext rejection, and network boundary
• install and exercise the bounded helper through the signed runtime observer

Security boundary

• uses read-only local SQL and fixed psql/TLS endpoints
• performs no application-row reads and requires no application database password
• never serializes credentials, private-key material, query output outside the closed controls, or raw errors

Validation

• ./scripts/run-ci.sh
• python3 scripts/validate-postgres-config.py
• bash tests/brio-runtime-observer-contract.sh
• python3 scripts/test-brio-postgres-control-receipt.py
• shellcheck on changed shell scripts

Stacked on #11 exact head becea64. No merge requested.