fix(services): drain the dev-services awaiting-input queue - #107

Drains the specs/dev-services Awaiting-input queue, applying the two fixes
that were recorded rather than applied and clearing the entries that no longer
describe anything open. Three commits, each revertable on its own.

1. fix(services) — converge the role's attributes, not just its existence

The existing pair guards on existence alone, so a role that already exists
without CREATEDB or LOGIN was left as found: the existence query returns
1, creation is skipped, the run reports zero changed tasks, and REQ-A1.4 is
unmet. A green run with an unmet requirement.

It is also invisible to the verification this bundle planned. test-spec.md
pins REQ-C1.2 to Task 6's idempotency re-run, and that second pass runs against
a role this file created one task earlier, which by construction already has
both attributes. The uncovered case is a host where someone made a same-named
role by hand — precisely REQ-C1.2's "already provisioned" condition.

This is what community.postgresql's postgresql_user does internally, and why
it is idempotent in the convergent sense rather than the create-once one. D-6
keeps that collection out, so the behaviour is spelled out here.

Verified against the running server, in both directions:

So the guard is shown to discriminate, not merely to pass. Both exits are 0,
which is why the when: compares stdout rather than rc.

Grants nothing beyond what the creation already asks for: same two attributes,
no superuser, no role membership. Placed after the creation so it reads
post-create state; the other order would predict an ALTER on every fresh host.

2. feat(ci) — run the stale-declaration scan in lint

REQ-B1.5 is pinned [test], which spec-format defines as "runs in the repo's
CI". Task 5 wrote and mutation-tested the script but could not wire it: that
edits .github/workflows/test.yml, a hard-disqualifier zone its own REQs never
called for. So the pin has been inaccurate — the script existed and nothing ran
it.

lint rather than services (linux): the scan reads tracked files and needs no
provisioned service, and lint already gates the whole matrix, so a stale
declaration now fails before anything spends a runner. Additions only, so
REQ-E1.4 is untouched.

Its three dependencies were checked rather than assumed: git from checkout,
python3 from setup-python, and PyYAML transitively from pip3 install ansible (the script exits early on import yaml). The job runs on
macos-latest, so the script was also read for GNU-isms — the sed calls are
portable and the scanning happens in python3. It passes locally on this branch.

3. docs(spec) — clear the resolved entries

Four of five entries no longer describe anything open, and a queue listing
resolved work is the same defect Task 5 existed to remove: a tracked statement
that stopped being true.

• Task 2 — the withdrawn exhausted-CI-minutes hypothesis. The outage was
  runner scarcity and cleared on its own.
• Task 3 — both halves resolved. The runtime clause is verified in CI now
  (services (linux) runs postgresql-access-test.sh and passes on main);
  the ALTER ROLE finding is applied in commit 1.
• Task 5 — the [test] wiring it recorded is applied in commit 2.
• Task 6 — asks for a re-read of gh pr checks 103, which is merged. The
  osx/upgrade reds are the standing 30-minute Brewfile timeout that
  reproduces on main and has its own observation entry.

Task 1 stays open. It needs ~/.config/dotfiles/private-identifiers, which
is machine-local by design and cannot be supplied from a PR.

spec-validate passes (0 errors, 0 warnings) on the trimmed bundle.

Not in this PR

~/.my.cnf was present on the Linux host — a symlink dated Jul 24, predating
the platform split — which fails Task 7's fourth Done-when clause. The Darwin
guard stops it being recreated but nothing removed the existing one. Removed by
hand on the host rather than declared absent in the role, by explicit choice;
worth knowing that another host carrying the same leftover would fail the clause
with no guard to catch it.

Verification

yamllint, gitleaks, syntax-check, ansible-lint pass via pre-commit on
every commit. spec-validate.sh and stale-declarations-test.sh both pass.