infra: policy-grade attribution separation for identity-mutating DB writes - archive owner role, limited non-owner app role, distinct human credentials

Raised out of ENAMEL-77 (audit-general-ca-muw87a70gy8z, 2026-10-06). Policy-grade attribution for identity-mutating DB writes is unreachable under the current shared postgres pool and manual credential: postgres can alter the archive trigger, its ACL and the history rows, and performedBy/GUC cannot attest a human. Even a full-row users archive trigger stays best-effort. audit named the requirements: a separate archive OWNER role; a limited non-owner app role with no archive DML, no trigger DDL, no direct userEmails write and no SET ROLE; a verified-session app actor; DISTINCT human DB credentials rather than a shared one; and external audit of maintenance actions. None of that is in any agent lane's gift - it is infra Elazar owns. I accepted best-effort for ENAMEL-76's build (ruling on that row) so a p1 identity-repair surface is not parked behind an indefinite infra ask; this row carries the real gap separately. Scope is fleet-wide, not enamel-only: the same shared-credential shape applies to every project whose audit-bearing writes run through one postgres role. Unblocks: a disputed identity correction becoming auditor-provable rather than corroborated-by-two-writable-surfaces.