fix(auth-pg): make BCR and database clocks authoritative (TIN-2923)

[Jess Sullivan (Jesssullivan)]

Authority

• Related to TIN-2923
• Related to TIN-4217
• Reuses the central package workflow carried by feat(ci): make next-major JS lane Bzlmod-only (TIN-89) ci-templates#149 / TIN-89.

Exact source

Candidate head: 3041be49ced8431697125cdbd2501b795e3e463c (GitHub-verified signature).

• Resolves tinyland-auth only through the immutable first-party BCR graph at exact compatible version 0.3.3; package metadata and the pnpm lock contain no in-house npm source.
• Pins the registry to commit ef734c4a26045a7b396913e6cf410e50fbe16635 and enforces lockfile error mode.
• Makes PostgreSQL UTC and expires_at authoritative for session liveness. Reads are non-mutating; tenant-scoped cleanup is the sole delete path.
• Adds destructive DateStyle and process-TZ regressions, exact-boundary behavior, tenant isolation, and non-mutating expired reads to graph-registered real-PostgreSQL tests. //:integration_test fails closed when its container substrate is unavailable.
• Removes the package-owned publisher and ad hoc nested-Bazel proof; this package consumes the canonical central workflow and does not publish itself.

Remote disposition at this exact head

Push requested CI run 34130368157. CodeQL and package / resolve-runner passed. package / validate failed before checkout or any package target ran: the selected runner had an empty TINYLAND_CI_BAZELISK_BIN, and rust-bazel-binary-custody refused it with TINYLAND_CI_BAZELISK_BIN must be one clean absolute path. This is a central GF custody/runner prerequisite, not package-test evidence. No local build, test, Nix, or package-install result is represented as validation.

Merge and release gates

1. ci-templates#149 must provide the signed immutable v4 package-workflow release and qualified Bazelisk custody/runner overlay; replace the exact-head canary ref with that released commit. Never fall back to v3.
2. The complete finite Bazel target set, including fail-closed //:integration_test, must pass remotely at the resulting exact source head.
3. Only after that proof may maintainers create signed v0.2.5, append its BCR entry, and run a real archive/BCR external-consumer proof.
4. No tag, registry entry, package release, or merge is authorized by this PR yet.

The branch is a source candidate, not a release receipt.

[linear-code]

TIN-2923

TIN-4217