Validate shared-state PostgreSQL security and migration access #2664

Parent: #2169. Implementation: #2624.

This issue tracks only the shared-state migration/access correction, leaving the broader reconciliation parent open.

The runtime must use the validated public tables, reject unsafe PostgreSQL catalogs, and preserve server-side persistence without granting browser roles access.

Acceptance:

• Pin PostgreSQL runtime tables to public regardless of search_path.
• Reject missing/unsafe relations, disabled or unforced RLS, client effective/inherited table or sequence access, client superuser/BYPASSRLS, missing service grants, and unsuitable server role privileges.
• Apply the checked-in migration twice safely and verify fresh-store persistence readback.
• Retain a bounded disposable PostgreSQL acceptance job with contents:read and no external database/provider calls.

Evidence already produced by #2624: 13 actual PostgreSQL 16.2 cases passed in https://github.com/groupthinking/EventRelay/actions/runs/43347589645 . Local source/adjacent checks are recorded in the PR. This issue does not certify production migration or authorize deployment; it closes only after the bounded PR is merged through the existing gates.