Persist audit artifacts and add deterministic PostgreSQL CI

[nicholas-ruest]

Summary

• replace process-local lineage, ERP mapping, and integration proposal Map stores with append-only, parameterized PostgreSQL tables in the existing RuVector database
• keep Cloud Run instances stateless and fail closed when persistence is unavailable
• reject duplicate artifact IDs with 409 immutable_conflict
• commit the npm lockfile, remove unused claude-flow, update uuid, and add deterministic Linux CI with a real PostgreSQL 16 + pgvector service
• canonicalize the public service identity as ruvector-service

Measured evidence

Gate	Baseline 4cd95ac	Candidate 4306e36
Node 20 build	pass	pass
Node 20 typecheck	pass	pass
ESLint	5 errors / 14 warnings	0 errors / 7 warnings
Unit tests	130 pass / 8 fail	158 pass / 0 fail
Line coverage	gate failed	90.14% (70% minimum)
Production audit	41 findings (10 high)	0 findings
Top-level production deps	included unused claude-flow	8
Flywheel holdout	0.40	1.00
Flywheel architecture anchor	0.00	0.80
Signed Flywheel replay	—	pass

MetaHarness 0.4.17 scored the candidate at 79 (compile/task 100, safety 95). Darwin 0.10.3 ran one real-sandbox generation at seed 101114; its candidate tied the 0.685 baseline and was discarded. Flywheel 0.1.12 promoted the source candidate under the frozen default gate and verified the signed replay.

Exact merge gates

This PR adds two commit-pinned Ubuntu 24.04 jobs:

1. locked Node 20.19.5 build/typecheck/lint/unit/coverage/audit
2. real PostgreSQL integration using a digest-pinned pgvector image, including persistence across fresh Express app instances and immutable duplicate rejection

Merge only after both jobs pass for the exact head and the branch remains zero commits behind main.

Rollback

Revert the merge commit. The schema changes are additive and existing audit rows remain intact; dropping tables is intentionally not part of source rollback.

No deployment, package publication, IAM change, force-push, branch-protection bypass, or alternate persistence service is included.