Add a data-preserving PostgreSQL standby replacement gate #4674

🤖 Generated by the Agentic Engineer

Problem

Database maintenance needs a controlled way to replace one failed standby without discarding its existing storage or affecting the primary and other healthy instances. A pod restart alone cannot repair an unusable recovery checkpoint.

Intended outcome

Provide a narrowly scoped, protected recovery path that retains the old standby volumes for investigation and lets the operator create a replacement from the primary. Refuse unknown identities, a primary target, another concurrent maintenance operation, missing backup evidence, and incomplete reads. Keep disruption budgets, normal deployment verification, and the retained data unchanged.

Acceptance

• Regression tests prove all refusals before any write, including stale target identities and a changing primary.
• Old PVCs and their volume bindings survive the replacement; no PVC or PV deletion is authored.
• The replacement becomes healthy before normal maintenance resumes.
• Execution requires the maintainer's scoped recovery approval; preparing the repair is not permission to run it.