feat: make binary download (theseus) opt-in rather than a default feature

[eljefedelrodeodeljefe]

Summary

Removes theseus from the default feature set of postgresql_embedded and postgresql_archive. With default features, the crates currently download and execute PostgreSQL binaries from GitHub releases at runtime. This change makes that behaviour explicit opt-in.

Two lines of Cargo.toml each, plus a changelog entry. No code changes; theseus itself is untouched and works exactly as before when enabled.

Why

1. default-features = false cannot serve as a guarantee. Cargo feature unification means that if any crate in a consumer's dependency graph pulls in postgresql_embedded with default features, the downloader is re-enabled for every consumer in that graph — silently, with no diagnostic. A consumer who has deliberately disabled it has no way to defend against this except auditing every transitive dependency on every update. Only a non-default feature gives that consumer an actual guarantee.

2. Runtime download-and-execute of binaries is a supply-chain surface a consumer should have to ask for. This isn't a judgement on theseus — it's the right default for a getting-started experience, and nothing here removes it. It's a judgement on defaults: fetching and running an executable from the network is the kind of thing that should appear in a consumer's Cargo.toml where a reviewer can see it.

3. It fails badly in the environments where it most often runs unexpectedly. api.github.com is unauthenticated-rate-limited. Under CI, or behind a shared egress IP, a consumer who never intended to download anything gets an HTTP 403 partway through an unrelated test run, reading like an outage. Making the download explicit means the consumer who enabled it also knows to expect that failure mode.

Migration

Consumers relying on default downloading add "theseus" to their feature list:

postgresql_embedded = { version = "...", features = ["theseus"] }

bundled, zonky, and github are unaffected — none were default.

Context

We run this crate as the embedded store for a self-hosted service and needed the downloader provably absent from the compiled binary, not merely disabled. We've verified the change compiles both with defaults (no archive provider) and with theseus explicitly enabled, on both main and v0.20.2. Happy to adjust the changelog wording, split the two crates into separate PRs, or add anything else that would make this easier to take.