Enforce PostgreSQL lifecycle and backup contracts #1988

Problem

The PostgreSQL chart needs to satisfy the rendered metadata, StatefulSet lifecycle, container security, and cloud identity contracts consistently.

Scope

• apply common annotations with deterministic precedence
• support explicit PVC retention policies for standalone, primary, and replica StatefulSets
• harden backup pods and support a dedicated workload identity
• preserve upgrade-safe defaults and document operational requirements
• validate the complete chart contract and behavioral matrix

Acceptance criteria

• make contract-check CHART=postgresql passes
• make validate-chart CHART=postgresql passes end to end
• documentation and playground behavior are synchronized in the site repository

Implementation: #1987