feat(credentials): add fail-closed Postgres environment sync - #10

Summary

• add a machine-readable Proton Pass to protected GitHub environment inventory for all six PostgreSQL environments
• add a fail-closed names-only audit and one-environment stdin-only sync helper
• reject repository secrets, unmanaged names, wrong public repository identity, and non-exact-main environment policies
• separate public policy variables from host-only/controller credentials
• correct the Brio PKI and database-password destination matrix
• add adversarial tests and run them from the complete CI entrypoint

Verification

• ./scripts/run-ci.sh
• ./scripts/sync-github-environments.sh --check --environment canary (names-only; expected to report the not-yet-created shared deployment item and two legacy canary names)

No credential values were read. No Proton Pass item or GitHub secret, variable, environment, or policy was mutated.