Render promotable Postgres manifests (#16)

[AntoineToussaint]

Closes #16.

Summary

• Produce promotable Postgres and bootstrap manifests without namespace ownership or secret values.
• Preserve the real migration workload while enforcing restricted pod security, explicit secret-key handoffs, and immutable images.

Test plan

• go test ./...
• CI full suite