docs(governance): record fuzesocial Postgres allocation (FuzeInfra#150)

[github-actions]

Provisioned fuzesocial DB (owner fuzesocial_app) + fuzesocial_app role
with schema/sequence grants on shared fuzeinfra-postgres. Role name uses
the app-supplied fuzesocial_app (matches FuzeSocial's already-written
bootstrap job) rather than the _user default.

Co-authored-by: Israel Weinberg izzywdev@users.noreply.github.com

Closes #150

[izzywdev]

@claude progress this one to completion

[claude]

Claude finished @izzywdev's task in 3m 53s —— View job

---

PR #151 progressed — now mergeable, gated only on human approval ✅

Done:

• Confirmed the underlying work (issue Provision fuzesocial DB + fuzesocial_app role on shared Postgres (Contabo k3s) #150) is complete & verified on prod — owner-confirmed FuzeSocial is deployed & healthy on Contabo k3s; credential fingerprint sha256:74ff2341a7374270 matched. No provisioning left.

• Diagnosed the stall: branch was far behind main and the registry table conflicted — main had gained fuzesales/fuzecontact/fuzeservice (via feat: provision per-service databases for FuzeSales, FuzeContact, FuzeService #153) but was missing fuzesocial (this PR never merged, so the allocation was unrecorded on main).

• Merged current main into the branch and resolved the conflict, preserving all rows and slotting fuzesocial in as active (FuzeInfra#150):

  App	Role	Database	Status
  fuzekeys	fuzekeys_user	fuzekeys	active (@claude Provision shared-Postgres role + fuzekeys database for FuzeKeys (Contabo GitOps deploy) #136)
  fuzesocial	fuzesocial_app	fuzesocial	active (Provision fuzesocial DB + fuzesocial_app role on shared Postgres (Contabo k3s) #150)
  fuzesales	fuzesales_svc	fuzesales	declared (feat: provision per-service databases for FuzeSales, FuzeContact, FuzeService #153)
  fuzecontact	fuzecontact_svc	fuzecontact	declared (feat: provision per-service databases for FuzeSales, FuzeContact, FuzeService #153)
  fuzeservice	fuzeservice_svc	fuzeservice	declared (feat: provision per-service databases for FuzeSales, FuzeContact, FuzeService #153)

• Pushed (b324945..450b841). PR flipped from CONFLICTING → MERGEABLE; branch is now 0 commits behind main.

Remaining — human-only gates I cannot perform:

• ⚠️ CI workflows show action_required — GitHub requires a maintainer to click "Approve and run workflows" on this bot branch (Harden Gate, Helm Validation, Infra Tests, terraform-plan-apply).
• ⚠️ REVIEW_REQUIRED — branch protection needs an approving review. I can't approve PRs (security restriction).

Once @izzywdev approves the workflow runs and the PR, auto-merge (SQUASH) is already enabled and will land it automatically — no further agent action needed.

Related: PR #152 (claude/issue-150-20260705-1012) carries the substantive docs/SECURE_AGENT_SECRET_HANDOVER.md mechanism from the same issue and is still open + CONFLICTING. That doc is not on main. It's out of scope for "this one" (#151), but if you want it landed too, reply and I'll resolve/progress #152 the same way.
· claude/issue-150-20260705-0855