feat(wasix): add PostgreSQL postmaster research runtime

[f0rr0]

Summary

• Add an independent liboliphaunt-wasix-postmaster research product, bringing the prior wasix-pg18-experiment work into the repository's runtime, source, graph, evidence, and documentation structure.
• Run a real PostgreSQL 18 postmaster with EXEC_BACKEND, preserving a fresh Wasmer instance for each backend.
• Pin and verify the patched Wasmer and wasix-libc source chain.
• Add reproducible runtime/core builds, export and linear-memory sealing, lifecycle correctness checks, performance/RSS probes, cold-ownership analysis, and immutable-carrier tooling.
• Keep this product independent of pg-durable and the production single-user WASIX runtime.

Architecture and findings

• Fresh backend instantiation remains the semantic invariant; optimizations do not collapse the design into an in-process single-backend shortcut.
• The release-O3 guest closes 35 modules, preserves all 4,739 table entries, and reduces:
  • fences: 1,111 pre-DCE to 995 sealed
  • exports: 23,187 to 383
  • functions: 16,923 to 12,777
  • globals: 10,911 to 1,020
• Latch-critical fence counts remain exact: SetLatch=2, ResetLatch=1, WaitEventSetWait=1.
• Under the same 256/224/0 cgroup envelope, moving the database from a portable regular file to Linux tmpfs improved throughput from 57,176 to 116,686 ops/s while PSS remained essentially flat (99.731 MiB vs 98.314 MiB; cgroup peak about 224.68 MiB). The dominant gap is file writeback/reclaim rather than duplicated physical backend memory.
• The remaining RSS target is Wasmer's unbounded retired 32 MiB coroutine-stack pool, with allocator arenas secondary; the evidence does not show a P1 strong-reference leak.

Reproducibility

• Wasmer patch SHA-256: 5d6bc8c6f8cf250daedcefc686f0ba8b0a17662ee9fc3a8c917497c9c5e2963d
• wasix-libc patch SHA-256: 59a936d5f6398b5b60c3e6e8b6c220a02a22603daf2eb0920f227021d56ffe7d
• runtime ABI identity: 5bb33347acd61470f80c55fb7905f188375b26f99252bbad2eb81f96c0374d18
• runtime recipe identity: e8312d92966dde2e9f379f15b508c7461d126ddb0e789f2504bcda54e705e384

Qualification boundary

This is intentionally a draft research product, not a release-carrier admission.

• The guest proof covers 27 side modules, but the prototype carrier currently packages only libpq, dict_snowball, and plpgsql plus initdb and postgres. The other 24 conversion modules are not in that carrier.
• A future carrier must derive the complete side-module closure from policy; this PR does not claim a new carrier or smoke result.
• Runtime/performance evidence is Linux x86_64 only.
• Follow-up memory work should bound and reclaim the retired coroutine-stack pool without weakening fresh-backend semantics.

Validation

• src/runtimes/liboliphaunt/wasix-postmaster/bin/check-prior-art.sh
• clean runtime build and repeated release-O3 core build with stable receipts
• cargo run -p xtask -- assets verify-committed
• tools/dev/bun.sh src/extensions/tools/check-extension-model.mjs --check
• tools/dev/bun.sh test tools/policy/source-fetch-core.test.mjs
• tools/dev/bun.sh tools/policy/fetch-sources.mjs all --validate-only
• tools/release/release-check.mjs: 1,594 passed, 15 platform-specific skips, 0 failed
• git diff --check