Pin PostgreSQL in hosted image lock

[SoundBlaster]

Summary

• Add the production PostgreSQL image to the hosted managed image lock.
• Resolve it by registry digest in the manual publication workflow.

Motivation

• Production Compose requires three digest-pinned images; the first lock covered only Platform and ingress.

Goals

• Make one validated lock authoritative for every production runtime image.
• Keep image publication separate from deployment authority.

Changes

• Resolve and record the PostgreSQL digest.
• Require and validate the PostgreSQL image ref.
• Update tests and deployment documentation.

Validation

• Tests added/updated for changed behavior
• Local checks passed

Commands run:

make hosted-managed-image-lock-contract
ruff check scripts/validate_hosted_managed_image_lock.py tests/test_hosted_managed_image_lock.py
git diff --check

Results:

• Image-lock contract: 4 passed.

Risks / Notes

• Backward compatibility impact: schema v1 locks without PostgreSQL are now rejected; no production deployment has consumed the incomplete lock.
• Migration/config changes required: rerun the image publication workflow after merge.
• Known limitations: none.

Checklist

• PR title clearly describes the change
• Scope is focused and minimal
• Documentation updated (or N/A)
• Workflow/artifact changes distinguish artifact presence from readiness/status
• Temporary or intermediate paths are scoped to the current run/task where relevant
• No secrets or sensitive data added