Per-agent Postgres login roles for DB-layer attribution (Mars/Pluto/Venus)

Elazar directive (2026-07-17, relayed via db-mars-cc). Goal: per-agent Postgres LOGIN roles on ALL 3 apps so DB-layer attribution (pg_stat_activity/logs) shows which agent modified what. DESIGN (Mars-verified: postgres role has CREATEROLE; applog_reader precedent exists): (1) per-agent LOGIN roles with DML-only least-privilege grants; (2) ALL DDL/migrations STAY funneled through the postgres role (agents SET ROLE postgres) so object ownership + default-ACL grantor stays single - avoids multiplying the default-ACL exposure surface each project just hardened (Mars mig 054/056; supabase_admin residual is the cautionary tale); (3) attribution: pg_stat_activity/logs via session_user, plus optionally stamp session_user in each project's archive triggers alongside app.user_id; (4) passwords distributed via llmmsg DM + ltm per standing secrets policy. CLASS-A per project (grants) -> per-project audit design-ping BEFORE apply. SEQUENCE: db-mars-cc drafts Mars reference impl first; Pluto/Venus adopt the ratified pattern. Per-app subtasks track execution.