v7.0.0-pr.3637.1

PR testing build for #3637 — provider-agnostic PostgreSQL (#3636, #3734, #3735, #3736).

Supersedes v7.0.0-pr.3637.0, whose pipeline failed at dockerize:migrators before publishing anything (glibc/qemu ldconfig segfault on the emulated architecture — fixed in this build).

Also carries the fixes from the whole-branch review: the in-cluster TLS switch now works as documented, and migrate.sh no longer masks database errors.

Not for production use.