Wire Graphile runtime pools with exact generation ownership

[Zetazzz]

The production Graphile middleware previously rebuilt a pool from control-plane options, bypassing configured runtime credentials. It now consumes the exact request-context pool, retains a cache-owned lease before asynchronous discovery, and keys builds/cache entries by logical service plus opaque runtime identity. A credential rotation therefore creates a new Graphile generation; concurrent requests coalesce even while module discovery is pending.

Runtime configuration requires explicit database/user/password and the same effective physical database target as the control route. Resolver failures never fall back. The server forwards all runtime options, keeps routing/module loaders on control pools, and preserves canonical request settings and the configured introspection role. Unconfigured single-login deployments remain supported.

Retirement belongs to the exact entry. It waits for both the public async Grafserv handler and response termination before releasing PostGraphile services and the cache lease; abort alone does not imply a query has settled. Shutdown closes build admission, drains pending builds, and disposes results that finish during shutdown. Logical service flushes retire every credential generation. Existing public Express handlers and PgPoolLease shape are preserved.

Dependencies and review scope: stacked on notification broker #1820 (which depends on #1754 → #1752 → #1744). This branch additionally merges #1747's awaited service-release prerequisite. Its PR diff therefore includes #1747 until that prerequisite lands; rebase after prerequisite landing to leave only runtime wiring in the final diff. This task has not merged any PR. The original five #1754 commits were preserved across the three splits; range-diff confirms no original unit was dropped.

Validation:

• Context: 150 tests; environment configuration: 12 tests; cache lifecycle: 37 tests passed.
• Server: 251 tests passed; the final ownership-publication adjustment also passed all 7 focused runtime middleware tests.
• Real routed HTTP: A login → A cache hit → B login on credential rotation, plus resolver rejection/missing credentials/target mismatch without fallback. Both tests passed with --forceExit=false --detectOpenHandles, and the process exited naturally.
• Affected CJS/ESM builds, frozen patched install, supply-chain policy, and CI matrix coverage passed.

Runtime role provisioning must permit the configured introspection/served roles and enabled module grants. This is credential separation, not the F18 runtime privilege audit. The broker remains an available capability; enabling the F24 generation subscription consumer is a separate change.

Refs constructive-io/constructive-planning#1693.

Full CI: https://github.com/constructive-io/constructive/actions/runs/34313334951 — all 17 jobs succeeded at 4c76a25c4531772f2f27f0c3bad9c692cc969990, including the enabled dedicated notification role/broker integration step.