release: add Docker release gate and normalize config upgrade

[NikolayS]

Summary

• adds repeatable Docker release-gate images and a safe local runner for PostgreSQL 14, 15, 16, 17, 18, and 19beta2;
• reuses the workflow's SQL assertions through shared test files, including previously missing degraded-mode coverage and real pg_cron scheduling/firing;
• closes the schema-equivalence blind spot by snapshotting columns in physical attnum order;
• fixes the resulting upgrade finding in the editable ash-1.5-to-2.0.sql migration: ash.config had fresh-vs-upgraded column ordinals that diverged beginning with v1.1;
• rebased onto current main, including chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 #159, ci: harden and speed up test workflow #145, test: inspect wait IDs at pair positions #154, fix: reject NULL elements in decode_sample (#143) #151, docs: remove legacy reader screenshots #149, fix: defer hourly rollup until minute coverage #133, and fix: keep report totals consistent #127.

Relates to #160.

ash.config red/green

The new ordinal-aware upgrade assertion was red before the migration fix on PostgreSQL 14 (and the same divergence affected every supported major):

ash.config column order differs: {singleton,current_slot,sample_interval,rotation_period,include_bg_workers,encoding_version,rotated_at,installed_at,version,debug_logging,num_partitions,sampling_enabled,skipped_samples,missed_samples,rollup_1m_retention_days,rollup_1h_retention_days,rollup_min_backend_seconds,last_rollup_1m_ts,last_rollup_1h_ts,insert_errors,register_wait_cap_hits}

No allowlist was added. The final migration takes an ACCESS EXCLUSIVE lock, validates the exact expected columns/types/nullability and supported catalog properties, snapshots the singleton row plus defaults, constraints, indexes, owner, effective table/column ACLs, and comments, then performs an atomic rename/create/copy/DROP RESTRICT/replay. Unsupported dependencies or properties abort and roll back. A canonical table is a no-op on reapplication and retains its OID.

The regression seeds non-default data, custom defaults/ACL state, a check constraint, a partial index, and a standalone-UNIQUE/self-FK pair. It verifies preservation and applies the migration twice.

Release-gate matrix

Command used on rebased HEAD:

PG_MAJORS="14 15 16 17 18 19beta2" \
RELEASE_GATE_JOBS=2 \
RELEASE_GATE_PULL=0 \
RELEASE_GATE_OUTPUT_DIR=/tmp/pg_ash-release-gate-postrebase-final3-20260727 \
devel/scripts/release_gate.sh all

Surface	PG14	PG15	PG16	PG17	PG18	PG19beta2
fresh-install	PASS	PASS	PASS	PASS	PASS	PASS
upgrade-chain	PASS	PASS	PASS	PASS	PASS	PASS
degraded-no-cron	PASS	PASS	PASS	PASS	PASS	PASS
degraded-no-pgss	PASS	PASS	PASS	PASS	PASS	PASS
degraded-neither	PASS	PASS	PASS	PASS	PASS	PASS
cron-path	PASS	PASS	PASS	PASS	PASS	PASS

Result: 36/36 PASS. The cron surface confirmed actual pg_cron job firing on every major, including postgres:19beta2 (there is no postgres:19 image yet).

Additional validation

• actionlint 1.7.7: PASS
• shellcheck 0.10.0: PASS
• hadolint 2.12.0: PASS
• workflow YAML and six-major matrix parse: PASS
• release-gate helper unit tests: 7/7 PASS
• bash -n devel/scripts/release_gate.sh: PASS
• git diff --check: PASS
• disposable release-gate containers after run: 0
• unrelated finance-control-* containers remained running and untouched: 5

This PR is intentionally left as a draft.

[NikolayS]

Superseded by and fully absorbed into #192, now merged as bfde011. Credit to #188 for the release-gate foundation: all 42 original #188-owned shared assertion sites were retained and executed on passing canonical paths; the same owned files contain 44 sites on final main after two later additions. #192 also preserved the pg_cron images/runner, schema snapshot ordering, and ash.config ordinal normalization.