EVO-70 Tier 1: trigger-wake for emailOutbox (pg_net)

Fleet EVO-70 Tier 1 (brainstorm bs-mrrih0cgp94 decision, 2026-07-19, audit-pluto-ca feasibility PASS): AFTER INSERT FOR EACH STATEMENT trigger on emailOutbox (transition-table nonempty check, not row-level) firing pg_net to POST a signed wake marker to /api/cron/drain-email-outbox. DB-native event delivery, removes pluto's app-level after()-call-site coupling for the enqueue-then-immediate-send happy path. Guardrails: trigger fn owned by postgres, fixed search_path, SECURITY DEFINER only if needed, REVOKE EXECUTE from PUBLIC/anon/authenticated; drain URL+secret read from Vault inside the fn, never in pg_proc source/cron.job text/payload/migration; payload=wake marker only, no email content; short pg_net timeout; worker keeps its own secret check+FOR UPDATE SKIP LOCKED+lease+idempotency. Tier 0's guarded cron is PERMANENT (pg_net request/response tables are UNLOGGED/beta — trigger is a latency accelerator, not the durability layer; emailOutbox stays SSOT). Rollout: add trigger alongside existing after() first, prove duplicate-safe (commit->1 wake, rollback->0, multi-row->1, concurrent trigger/after/cron->1 send), THEN retire pluto's app-level after() initiators. Scoping: pluto's outbox-bypass sync sends (sendAdminEmailInline, sendOperatorAlert, sendAccessRequestNotification, sendSupportReplyEmail, attachment reports) stay OUT of trigger scope — they never touch emailOutbox by design. Class-A (DB trigger + auth-adjacent secret handling): plan-first, audit design-ping before impl. Gated on Tier 0 landing first. Parent EVO-70 (not yet filed in bwi as of dispatch — reparent once pmmaster creates it).