Providers read the seat's plans and retire only on the operator's yes, removing the credential

ADR 0570 clauses 2 and 5: gitea, keycloak, postgres and route-adapter read mesh-provisioner.plans and
.provisions instead of the controller's assignments. postgres hands the database to a keeper and drops the
login; keycloak replaces the client's secret and keeps the client, so the data stays (issue 1954, V4).

modules/postgres/cmd/postgres-provider/harness_test.go

@@ -120,8 +120,8 @@ func TestProvisionerCreatesTheDatabaseThenItsExtensions(t *testing.T) {
 	if err := a.Retire(ctx, "mesh_ace_letta", nil, "test", time.Now()); err != nil {
 		t.Fatal(err)
 	}
-	noDrop(t, f.statements())
-	if !has(f.statements(), `NOLOGIN`) {
+	// On the operator's yes the login goes and the database stays (ADR 0570 clause 5).
+	if !has(f.statements(), `^DROP ROLE "mesh_ace_letta"$`) || has(f.statements(), `DROP DATABASE`) {
 		t.Fatal(f.statements())
 	}
 }