feat(helm): postgres control-plane profile — ADR 0010 slice 6 (E4)

[brownjuly2003-code]

What

E4 / ADR 0010 rollout slice 6 — the Helm half of the control-plane
externalization. The app-side PostgresControlPlaneStore shipped in slice 5;
this releases the render-gate ratchet so the chart can express the multi-replica
scale profile.

Changes

• values.schema.json — controlPlane.store enum ["embedded"] →
  ["embedded", "postgres"]; new controlPlane.postgres.{existingSecret,dsnKey}
  (DSN sourced from an operator secret, mirroring the ClickHouse password — never
  inlined).
• values.yaml — controlPlane.postgres defaults + updated gate comment.
• templates/deployment.yaml — wire AGENTFLOW_CONTROLPLANE_STORE (always,
  self-documenting) + AGENTFLOW_CONTROLPLANE_PG_DSN from a secretKeyRef when
  store=postgres, with required() on existingSecret (fail-closed; no silent
  embedded fallback).
• tests — ratchet test updated for the extended enum; new render tests for
  the postgres env/DSN wiring, gate release for multi-replica + HPA, missing-DSN
  failure, and the still-gated duckdb-backend case.
• k8s/staging/values-staging-scale.yaml.example — ready scale overlay
  (replicaCount=2, clickhouse + postgres) layered on values-staging.yaml.
• scripts/k8s_replica_correctness_verify.sh — automates the pod-count +
  cross-pod registration-visibility checks (Phase 3). bash -n only.
• docs — cutover-plan Phase 3 checkboxes + verify recipe, helm-deployment
  scale section, ADR 0010 rollout item 6 execution note.

Verification

• helm template (6 profiles) + helm lint (base + scale overlay) — clean.
• tests/unit/test_helm_values_contract.py — 18 passed.
• Full unit suite — 1626 passed; ruff check (src/tests/scripts) + ruff format --check clean. (mypy CI scope is src/ only — no src/ touched.)

Deferred (Mac/CI tail)

The two-real-pods live run — kind at replicaCount=2 plus the ADR 0010
replica-correctness checks (exactly-one delivery per (webhook,event), one alert
page per incident, cross-pod registration visibility) — needs Docker/kind,
unavailable on the authoring host. Its store-level guarantee is already
live-verified by slice 5's 31/31 standalone-PostgreSQL probes; Phase 3 adds only
the topology proof. Recipe + overlay + verify script are in this PR.

🤖 Generated with Claude Code

[github-actions]

DORA Metrics

• Window: last 30 days
• Branch: main
• Deployment frequency: 125 total / 29.17 per week
• Lead time for changes: avg 0.42h / median 0.0h
• Change failure rate: 75.2% (94/125)
• MTTR: 0.29h across 2 incident(s)