feat(provider): implement the cnpg-hybrid driver (JSONB and Apache AGE)

[devantler]

🤖 Generated by the Agentic Engineer

Child of #33. Blocked by the provider interface child.

User story

As a platform operator, I want provider: cnpg-hybrid to serve document and graph shapes from a single CloudNativePG cluster, so development and smaller environments do not each pay for a dedicated engine operator.

Scope

• Document: core PostgreSQL using JSONB column types.
• Graph: a CNPG cluster on a custom image with Apache AGE pre-installed and loaded via shared_preload_libraries.

Acceptance criteria

• provider: cnpg-hybrid provisions a CNPG cluster for both document and graph, satisfying the same provider interface as the native drivers.
• The AGE image is built and published by this repository's existing signed release workflow and pinned by immutable digest — not pulled from an unpinned third-party tag.
• shared_preload_libraries is set through CNPG's supported configuration surface, and the extension is verified loaded and queryable, not merely installed.
• The capability difference against the native providers is documented so cnpg-hybrid is chosen deliberately rather than discovered to be insufficient in production.
• Both feature-flag states tested.

Note

shared_preload_libraries requires a restart, so changing it on a live cluster is not a hot operation — the rollout path for an existing product needs to be stated, not assumed.

Rough size: L.