e2e: the whole grant for a database — a consumer connects with what the mesh delivered

Assigns a postgres provider (its runtime carries psql) and a module that requires
postgres-database; the mesh mints one password, postgres's provisioner creates a role
and database under the mesh's login with it, and the consumer connects to its database
with the delivered credential (a password-checked connection) — select 1. Nothing placed
by the test. The postgres half of the per-backend provider proof (ADR 0052/0053).

Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF

scenarios/postgres-node.yml

@@ -0,0 +1,30 @@
+# One machine that becomes a mesh and grants a consumer a database from an assigned postgres provider.
+#
+# The redis mesh-grant bed proves the whole provider/consumer contract for a cache; this proves it for
+# a database (novox/hq ADR 0052/0053): postgres's runtime carries psql, its provisioner creates a role
+# and database under the login the mesh derived with the password the mesh minted, and a consumer
+# connects to its own database with only what the mesh delivered.
+scenario: postgres-node
+
+segments:
+  hosting:
+    kind: public
+    cidr: [192.0.2.0/24]
+
+machines:
+  anchor:
+    at: { segment: hosting, address: [192.0.2.10] }
+    inbound: allow
+    memory: 3GiB
+    cpus: 2
+
+images:
+  - postgres:17-alpine
+  - cloudamqp/lavinmq:latest
+  - mesh-control:development
+  # postgres's runtime, built by scripts/build-module-runtime.sh postgres (it carries psql), stocked
+  # into the scenario's own registry.
+  - mesh-runtime-postgres:development
+
+place:
+  all: [host, runtime]