feat(#16): bounded final HA acceptance

[rblake2320]

Scope

Bounded BPC HA mechanism slice: signed external cutover witness, source pre-commit fencing, three-member durable Redis quorum, signed snapshot import, authenticated tail replay, promotion readiness/activation, and a database-enforced least-privilege mutation boundary.

Executable evidence

• Three independently initialized PostgreSQL authorities (A, B, control) and three distinct Redis server identities with AOF + appendfsync always.
• Publisher SIGKILL/restart and lost-ACK reconciliation with measured data-loss RPO 0.
• In-flight DML loses Redis quorum and is rolled back by the real pre-commit fence.
• Fresh B snapshot at C, authenticated C+1..N tail, exact applied-history/state verification, promoted B origin at N+1.
• Signed Redis/readiness/activation evidence binds PostgreSQL lineage and fresh node identity; production custody is non-exportable TPM/HSM.
• Full pinned bpc_ha catalog/version attestation, transactor-bound readiness, distinct guard/snapshot SPKI custody.
• Exact runtime credentials on A and B have no direct pair/pending/outbox/evidence DML, ticket-key read, or schema-create authority.
• One authenticated SECURITY DEFINER append function verifies a single-use DB-clocked transaction/lease/payload/policy-bound ticket before locking, then locks/rechecks/admission-checks/inserts/advances without a caller-controlled lock gap.
• Every governed append creates a local-mutation proof. A deferred database constraint aborts commit unless the exact outbox tuple's governed local source mutation completes that proof. The append-only authenticated regression reaches COMMIT, is rejected, and authoritative reconciliation proves no checkpoint/outbox/pair state committed.
• maxPendingRows is bound into the canonical policy, ticket HMAC, and DB recomputation. A valid committed ticket reused with a raised limit fails closed.
• Approval and rotation are single database-controlled composite actions. Approval locks and exact-compares current pending state, then deletes+inserts atomically. Rotation locks and exact-compares every current-old field, then rotates+inserts atomically. Direct authenticated lower-level mismatched-live-state attempts fail and roll back outbox+DML.
• Runtime posture rejects effective INSERT/UPDATE/DELETE/TRUNCATE/TRIGGER across pair, pending, all public outbox/evidence, and all bpc_ha authority tables, plus ticket-key access, object replacement, and controlled-function owner/ACL drift.
• One Redis unavailable remains readable; two unavailable fail closed; majority rollback is rejected against the control witness.

Local exact-head verification at d007e75: workspace tests green (@bpc/server 340/340), package boundary 3/3, and real frozen A/B/control PostgreSQL + three-Redis acceptance green.

Boundary

Draft pending frozen independent review and exact-head hosted CI. Production ticket signing requires a non-exportable HSM/TPM policy key and a closed signer policy that validates every sealed field, current external authority, and independently governed admission/approval-capacity limits. The drill signer is test-only and not exported. Stolen runtime DB credentials are inside the tested database boundary; signer policy/key compromise is a distinct revocation-and-recovery event. No universal-uptime, government-authorization, or certification claim. Issue #16 remains open pending reviewed merge disposition.