EVO-56: adopt per-agent Postgres login roles (held — Mars drafts reference impl first)

Elazar directive via pmmaster-evolutiva-cc 2026-07-17. Per-agent Postgres LOGIN roles for DB attribution. HOLD: Mars (MARS-490) drafts the reference impl first, venus adopts the ratified pattern once released - don't build in parallel (avoids per-app drift). Design gist: per-agent LOGIN roles, DML-only least-privilege, ALL DDL still via postgres role (SET ROLE) so object-ownership + default-ACL grantor stays single, attribution via session_user. Class-A per app -> audit design-ping before apply. No action until pmmaster releases venus to adopt.