[PaleHazy]

Summary

• add an application-native, idempotent managed PostgreSQL datasource reconciler
• read the database password and trust root only from mounted Secret files and require TLS verify-full
• project the dedicated Hazy Trade read-only credential from Azure Key Vault with External Secrets
• configure the production datasource declaratively and provide a rollout revision for credential rotation

Safety

• ownership is keyed by explicit managedBy/managedKey metadata; unmanaged aliases are never adopted
• create and update both pre-connect before persistence and reject alias collisions
• the production role is a dedicated database-enforced read-only role; no password or connection URI is committed

Verification

• managed reconciler tests: 7 passed
• bootstrap adapter tests: 5 passed
• focused Java reactor builds: passed
• Helm lint/render test: passed
• production Helm render plus Kubernetes server-side dry-run: passed
• independent security/correctness review: no merge-blocking findings