Add PostgreSQL DurableStore substrate for WP-03

Introduce remora-durable with pool/migrations, a RemoraApiMutation-shaped
ledger, claim-fenced outbox projection, CAS helpers, and keyset cursors,
plus a kind Job acceptance suite against the hermetic fixture.

tests/kind/durable-job.yaml.in

@@ -0,0 +1,26 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: durable-substrate
+  namespace: remora-testbed
+spec:
+  activeDeadlineSeconds: 600
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 300
+  template:
+    spec:
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      restartPolicy: Never
+      containers:
+        - name: tests
+          image: @@TEST_IMAGE@@
+          imagePullPolicy: Never
+          env:
+            - name: DATABASE_URL
+              value: postgres://remora:synthetic-postgres@postgres:5432/remora?sslmode=disable
+            - name: REMORA_DURABLE_REQUIRE_DB
+              value: "1"
+          resources:
+            requests: {cpu: 250m, memory: 256Mi}
+            limits: {cpu: "2", memory: 1Gi}

tests/kind/lib.sh

@@ -276,7 +276,8 @@ destroy_fixture() {
     "$RUNTIME/dependencies.yaml" \
     "$RUNTIME/fixture.env" \
     "$RUNTIME/probe.yaml" \
-    "$RUNTIME/sample-job.yaml"
+    "$RUNTIME/sample-job.yaml" \
+    "$RUNTIME/durable-job.yaml"
 }
 
 kube() {

tests/kind/run-durable-job.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+source "$ROOT/tests/kind/lib.sh"
+
+USER_KUBECONFIG_BEFORE="$(user_kubeconfig_digest)"
+SUCCEEDED=false
+OWNS_FIXTURE=false
+
+cleanup() {
+  local status=$?
+  trap - EXIT INT TERM
+  if [[ "${REMORA_TESTBED_RETAIN:-0}" = 1 ]] && [[ "$SUCCEEDED" != true ]]; then
+    printf 'retained kubeconfig: %s\n' "$KUBECONFIG_PATH"
+    printf 'retained context: %s\n' "$CONTEXT"
+    exit "$status"
+  fi
+  if [[ "$OWNS_FIXTURE" = true ]]; then
+    destroy_fixture || status=1
+  fi
+  if [[ "$(user_kubeconfig_digest)" != "$USER_KUBECONFIG_BEFORE" ]]; then
+    printf 'user kubeconfig changed unexpectedly\n' >&2
+    status=1
+  fi
+  exit "$status"
+}
+
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+acquire_fixture_lock
+REMORA_REAL_NERDCTL="$(command -v nerdctl)"
+export REMORA_REAL_NERDCTL
+"$REMORA_REAL_NERDCTL" --namespace default build \
+  --file "$ROOT/Dockerfile.test" \
+  --target kind-durable-runner \
+  --tag remora-kind-durable:local \
+  "$ROOT"
+OWNS_FIXTURE=true
+setup_fixture
+load_local_image remora-kind-durable:local
+sed "s|@@TEST_IMAGE@@|remora-kind-durable:local|g" \
+  "$TESTBED/durable-job.yaml.in" > "$RUNTIME/durable-job.yaml"
+run_job_manifest "$FIXTURE_NAMESPACE" durable-substrate "$RUNTIME/durable-job.yaml"
+SUCCEEDED=true
+printf 'durable substrate package test Job passed\n'