Add tenant-density validation and production evidence

[yyyyaaa]

Context

Part 6 of 6 in the draft tenant-density stack: #1654 → #1655 → #1656 → #1657 → #1658 → #1659 (this PR). This top layer contains the measurement/hostile-validation rig and records what the stack has and has not proved.

It refreshes the useful process-isolation, open-loop load, canary, and artifact ideas from #1335. The old blueprint-pooling results are labeled historical because they depended on the rejected SQL-rewrite design and included an inconclusive isolation canary; they are not evidence for this dedicated-instance candidate.

What changes

• Adds a cperf harness that scores resident complete tenants only when every configured GraphQL surface is warm, serving, and backed by conclusive per-surface canaries.
• Records fresh-process provenance, retained heap, RSS, cold-build time, PostgreSQL telemetry, throughput/p99, cache/build counters, request samples, server logs, and immutable run attestations.
• Adds production-shaped catalog fixtures plus A/B/C hostile checks for generated/plugin SQL, metadata, functions, sequences, prepared reuse, poisoned GUCs, rollback, schema drift, invalidation, concurrent builds, realtime, and alternating connection reuse.
• Fails closed on missing tenants, surfaces, capabilities, telemetry, canaries, ramp points, or paired comparison arms; the checked-in fleet is intentionally non-qualifying until real credentials/providers are supplied.
• Documents the old-stack disposition, plugin SQL audit, security verdict, upstream introspection review packet, and remaining production gates.

Evidence so far

• The secure scoped candidate measured 6.55 MiB retained heap and 130.34 ms cold build versus stock at 449.42 MiB and 3,495.95 ms on the clean 62,298-pg_class single-surface fixture; final RSS delta was 47.77 MiB versus 1,106.94 MiB.
• The latest disposable PostgreSQL 18 A/B/C run passed 56/56 hostile checks with zero cross-tenant tokens, including same-backend prepared reset and realtime-resident instances.
• The harness passed 233/233 tests, its CJS fixture suites passed 107/107, and the cumulative monorepo build passed.

Why this remains a draft

These results prove a large per-instance memory improvement and strong hostile-fixture isolation, but they do not yet prove complete-customer tenants per GiB in production. The required 1/2/4 GiB matrix still needs three repetitions per arm, 15-minute mixed workloads at every ramp point, and a two-hour maximum-density churn soak, followed by final throughput/p99 measurement on the security-complete code.

Production also remains blocked on the atomic route/security revision and WebSocket revocation work in #1658, a production-schema RLS/ACL policy proof, an explicit per-API auth-required contract, upstream Graphile review/removal of temporary patches, multipart storage byte roundtrips, and intended external-provider gates. No security check may be removed to recover a performance number.