feat(pg-auth): wire pgauth into gc bd subprocess env (slices 1-3)

[quad341]

What this changes

Brings Postgres-backed credentials end-to-end through the gc bd
subprocess. Three independently-designed slices ship together because
the chain only makes sense functional end-to-end:

1. PG-aware MetadataState + parse validation

internal/beads/contract/files.go learns four new Postgres fields on
MetadataState, JSON tags on all eight, a LoadMetadataState
constructor, a typed MetadataParseError, a mixedBackendField
selector, and PG-key defaults + cross-backend scrubbing in
EnsureCanonicalMetadata. Validation order matches the design spec
(E1 → E3 → E2 → E4 → E5).

2. pgauth credential resolver

A new internal/pgauth package mirrors the existing
internal/doltauth shape: tiered source resolution
(env → password file → ~/.pgpass → managed-store), a typed
Source enum, no external os.Getenv reads from inside the package
(enforced by no_external_env_test.go).

3. bd_env wiring

gc bd now resolves Postgres credentials at exec time and projects
them into the bd subprocess explicitly via cmd/gc/bd_env.go —
mirroring the existing Dolt auth pattern. We do not widen
IsSensitiveKey or mergeRuntimeEnv's inheritance filter; the split
between inheritance (still strict) and resolution (at exec) is
deliberate.

Review notes

• The chain has been reviewed in two passes:
  • Slice 1 (MetadataState parse validation): ga-pnqg.1 PASS at the
    original SHA b7015a05. Patch is content-identical to the rebased
    commit 31fa03c1 shipping here (verified line-for-line).
  • Slice 3 + chain (bd_env wiring + integration): ga-6zqpw PASS at
    ea9af929. The fix-up commit 93eec8b9 resolves four lint
    findings only (misspell, unused param, exported-const doc,
    gofumpt) — mechanical, no behavior change.
• Slice 2 (resolver) ships as commit 871313ef. It was tracked
  separately under a closed review bead (ga-cwq1, withdrawn when
  PR feat(contract): add Postgres MetadataState fields with parse validation #1727 was closed in favor of local-only iteration) and was
  reviewed implicitly as part of the slice-3 chain review at
  ea9af929.
• Branch's rebase base is origin/main 8a76142; current origin/main
  has moved 13 commits forward. Test merge confirms zero conflicts;
  build + vet + lint + targeted tests pass on the merged tree.

Review notes

• New package: internal/pgauth (no role names, no judgment calls in
  Go — tier resolution is a static priority list).
• IsSensitiveKey is not modified — PG passwords stay outside the
  inheritance filter; resolution is the only path that can produce
  them. Auditable.
• MetadataParseError distinguishes parse vs validation failures so
  callers can render different operator hints.
• bd_env.go is the only cmd/gc change; everything else is
  package-internal additions.

Test plan

• go build ./..., go vet ./..., golangci-lint run clean (full repo).
• go test ./internal/pgauth ./internal/beads -count=1 PASS on
  both as-is HEAD and a test-merge into current origin/main.
• no_external_env_test.go enforces internal/pgauth reads no
  external env directly.
• Release gate: release-gates/ga-6zqpw-pg-auth-slices-1-2-3-gate.md

🤖 Deployed by actual-factory

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews

[codecov-commenter]

Codecov Report

❌ Patch coverage is 86.05341% with 47 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/pgauth/auth.go	82.05%	17 Missing and 11 partials ⚠️
cmd/gc/bd_env.go	82.10%	10 Missing and 7 partials ⚠️
internal/beads/contract/files.go	97.67%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!