feat(infra): install CloudNativePG operator and shared-cluster

.claude/CLAUDE.md

@@ -140,7 +140,7 @@ Things not in any single grep-able file:
 - **Wildcard DNS**: `*.live.k8s.phl.io` → the Envoy LB `45.79.246.168`. DNS is managed in OpenTofu at [CodeForPhilly/ops](https://github.com/CodeForPhilly/ops) → `tofu/dns`; a host with no specific record simply follows the wildcard, so new apps need no DNS change at all.
 - **Apex domains in tree**: `balancerproject.org`, `choosenativeplants.com` (+ `www.`), `codeforphilly.org` (+ `www.`), `penn-chime.phl.io`, `vaultwarden.phl.io`, `bitwarden.phl.io`. Apex ACME challenges only work once DNS points at Envoy — plan cutover and cert issuance together for these. `choosenativeplants.com` is at **Namecheap**, not Cloud DNS, so it can't be moved from the ops repo.
 - **A new hostname is briefly down between DNS and cert.** The cert can't issue until the hostname resolves to Envoy (Let's Encrypt has to reach the solver), and Envoy's HTTPS listener doesn't program until the cert Secret exists — meanwhile HTTP 301s into a listener that isn't there. Roughly 60–90s. Keep TTLs at 60s.
-- **No cnpg / shared-cluster** on this cluster yet. If a database is needed, it ships per-app (e.g. vaultwarden runs its own PostgreSQL StatefulSet via the gissilabs chart; chime + third-places similar).
+- **cnpg is landing.** `_infra/cloudnative-pg/` installs the operator (chart v0.28.0) and a `shared-cluster` Cluster, mirroring cfp-sandbox-cluster. It has **no backup configuration** — do not let it hold the only copy of anything until an object store lands (CodeForPhilly/balancer-main#526). Existing apps still ship their own database per-app (vaultwarden runs a PostgreSQL StatefulSet via the gissilabs chart; chime + third-places similar); nothing has been migrated onto the shared cluster yet.
 
 ## Guardrails
 

.holo/branches/k8s-manifests/_infra/cloudnative-pg/operator.toml

@@ -0,0 +1,4 @@
+[holomapping]
+holosource = "cloudnative-pg-chart"
+root = "charts/cloudnative-pg"
+files = "**"

.holo/lenses/cloudnative-pg.toml

@@ -0,0 +1,14 @@
+[hololens]
+container = "ghcr.io/hologit/lenses/helm3:latest"
+
+[hololens.input]
+root = "_infra/cloudnative-pg/operator"
+files = "**"
+
+[hololens.output]
+merge = "replace"
+
+[hololens.helm]
+namespace = "cloudnative-pg"
+release_name = "cloudnative-pg"
+include_crds = true

.holo/sources/cloudnative-pg-chart.toml

@@ -0,0 +1,3 @@
+[holosource]
+url = "https://github.com/cloudnative-pg/charts.git"
+ref = "refs/tags/cloudnative-pg-v0.28.0"

_infra/cloudnative-pg/namespaces.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloudnative-pg

_infra/cloudnative-pg/shared-cluster.yaml

@@ -0,0 +1,24 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: shared-cluster
+  namespace: cloudnative-pg
+spec:
+  instances: 2
+  imageName: ghcr.io/cloudnative-pg/postgis:18-3-system-trixie
+
+  storage:
+    # Explicit, unlike sandbox, which takes the cluster default. `-retain` keeps
+    # the Linode volume if the PVC is ever deleted — on this cluster that is the
+    # difference between an incident and an outage.
+    storageClass: linode-block-storage-retain
+    size: 20Gi
+
+  # No `managed.roles` yet: the balancer role's passwordSecret has to be sealed
+  # into cloudnative-pg.secrets/ first, and cnpg reports a role reconcile error
+  # for as long as the Secret it names is absent. The role and the balancer
+  # Database CR land together in the follow-up PR.
+  #
+  # No `backup:` stanza yet either — it needs an object store bucket plus
+  # credentials that do not exist. This cluster must not hold the only copy of
+  # production data until that lands. See CodeForPhilly/balancer-main#526.