v2.0.3

Fix identity-pool failures caused by stalled PostgreSQL saves and prevent stale processes from overwriting newer state after reconnecting.

• Keep identity state in RAM and save finished operations in the background. Requests continue during stalled saves while the service retains database ownership.
• Pause new identity work when the database connection is lost. Recover the connection and verify a persisted ownership token before resuming, including when another process has already started and stopped.
• Preserve pending identity and proxy-health updates across recoverable errors. Schema and permission errors pause new work until persistence succeeds.
• Bound shutdown persistence to ten seconds after request drain, including stalled saves and connection cleanup. Skip reconnecting when no state remains unsaved.
• Register missing devices at startup without fetching signing material. Fetch signing material on demand and refresh it after one hour.

Upgrade: startup creates the scrap_ownership table in DB_SCHEMA; the database role needs permission to create it. Run one active service process per schema and allow 45 seconds for container shutdown. A hard crash can still lose changes that have not reached PostgreSQL.

Validation: make check and make lint passed, including race-enabled PostgreSQL tests, the CGO build, staticcheck, and govulncheck. All three PR CI checks passed. Regression coverage reproduces stale identity and proxy-health overwrites before the fix and verifies safe reconnect behavior afterward.

Pull request #20 · Full changes since v2.0.2