Establish the tenant GraphQL runtime boundary

[yyyyaaa]

Context

This is part 1 of 6 in the draft Graphile tenant-density stack. The goal is to serve more complete tenant GraphQL surfaces per GiB without weakening tenant isolation. Review and merge the stack from the bottom up:

1. Establish the tenant GraphQL runtime boundary #1654 — runtime boundary (this PR)
2. Isolate Graphile plugin and storage data paths #1655 — built-in plugin and storage isolation
3. Govern Graphile cache and realtime lifecycles #1656 — cache and realtime lifecycle
4. Build exact Graphile schemas from scoped introspection #1657 — scoped Graphile build
5. Fail closed at the tenant request boundary #1658 — request admission and runtime enforcement
6. Add tenant-density validation and production evidence #1659 — qualification harness and evidence

This stack supersedes draft #1652 and deprecates the old #1330–#1335 production design. The useful plugin, cache, and harness work was retained, but the SQL-rewrite/blueprint-pooling design from #1333/#1334 was rejected: RLS filters rows after object routing, so it cannot prove that rewritten SQL, plugin SQL, metadata, functions, sequences, indexes, or prepared statements reached the correct tenant.

The replacement keeps one Graphile instance per exact physical tenant/API build contract. Density comes from reducing each dedicated instance's retained state and governing its lifecycle, not from sharing a canonical instance or rewriting SQL between tenants. BM25 remains enabled against physical schema-qualified indexes.

What this PR establishes

• Separates control-plane PostgreSQL credentials from optional least-privilege GraphQL runtime credentials, with exact runtime target checks and explicit resolver contracts.
• Keys pools by an opaque cryptographic identity over the normalized connection, credentials, purpose, pool settings, driver, and sanitation mode instead of a database name or routing label.
• Sanitizes reused runtime checkouts with DISCARD ALL, clears node-postgres and Graphile prepared-statement bookkeeping, and destroys a client when reset fails.
• Initializes the complete request security-GUC set, including empty absent claims, role/read-only state, row_security, and a pinned allowlisted search_path.
• Makes routing/security/storage metadata loaders exact and bounded, adds lease-aware LRU primitives, and introduces the shared notification foundation consumed by the realtime layer in Govern Graphile cache and realtime lifecycles #1656.
• Defines the public configuration contracts used by the later stack layers so their consumers never precede their API types.

Security position

Hostnames and service keys are routing labels, never pool or build isolation keys. RLS remains defense in depth; this branch does not use RLS as proof of physical routing. Arbitrary caller plugins remain trusted process code and are denied by default in production later in the stack.

Validation

• Frozen lockfile installation passed.
• Clean CJS/ESM builds passed for GraphQL types/env, request context, server utilities, pg-cache, pg-env, and pg-query-context.
• Focused suites passed: GraphQL env 42, server-utils 14, pg-env 5, pg-query-context 7 with 1 environment-gated skip, pg-cache 119 with 5 environment-gated skips, and express-context 65.
• The cumulative top-of-stack monorepo build also passed.

Why this remains a draft

This is a foundation, not a standalone production rollout. Runtime object/role admission, exact Graphile build identity, WebSocket admission, scoped introspection, and qualification evidence arrive later in the stack. The full candidate remains a production no-go until the atomic versioned route/security contract, production-schema policy proof, upstream Graphile review, complete tenant-density matrix, and long-duration churn soak are finished.