Add promotable Postgres GitOps output (#16)

[AntoineToussaint]

Closes #16.

Summary

• Make the service-owned Postgres tree safe to promote by enforcing the released versioned output-profile boundary.
• Preserve populated Secrets for explicit local apply while making GitOps output secret-reference-only, service-scoped, restricted, and digest-pinned.
• Advance the agent to v0.0.109 and pin CI/release workflows to the Core v0.2.51 release commit so the merged tag can produce resolvable Codefly artifacts.

Test plan

• go test ./... -count=1 -timeout=10m
• go build ./...
• go vet ./...
• go mod tidy -diff
• go mod verify
• actionlint .github/workflows/ci.yml .github/workflows/releaser.yml
• goreleaser check
• goreleaser release --snapshot --clean
• Build and start the real Postgres image as UID 70 with a read-only root filesystem and only the declared writable mounts, then run a live SQL query
• Resolve github.com/codefly-dev/core v0.2.51 through the Go module toolchain

Risk

• PostgreSQL and the migration Job now use read-only root filesystems. The locked runtime image passes the matching smoke test; custom docker-image overrides must also operate with only the declared data, socket, and temporary mounts writable.