flows: run on pg8000 instead of psycopg (LGPL, Category X) #1716

Value this issue delivers

psycopg is LGPL-3.0, and the FINOS license and CVE report on vexa-core (2026-09-18) reads LGPL as Category X — as ASF does. It was the flows engine's production Postgres driver, so every shipped flows image, the Lite image and the Helm-rendered runtime carried an LGPL binary. The engine talks to Postgres through SQLAlchemy, so the driver is replaceable; what is not free is the URL, because pg8000 does not accept libpq's sslmode and a naive swap would quietly change whether a deployment uses TLS.

What this issue ships

• core/flows runs on pg8000 (BSD-3-Clause): postgresql+pg8000:// in the Dockerfile pin (pg8000>=1.31), pyproject.toml, uv.lock, the compose file, deploy/lite, and the Helm flows template — bootstrap and runtime URLs alike.
• translate_pg8000_url in core/flows/src/flows/db.py: strips the libpq-only sslmode and maps it onto pg8000's ssl_context, keeping application_name and every other parameter, so each sslmode the Helm template can emit keeps its meaning; an operator who set nothing gets pg8000's own try-SSL-then-fall-back default, as under libpq.
• core/identity/services/admin-api keeps psycopg as a dev-group dependency only, for the testcontainers schema convergence its tests do; both of its Dockerfiles install --no-dev, so no shipped image contains it.
• The SSL translation table written down in the flows READMEs and the db.py docstring; docs/docs/configuration.mdx § Workflows names +pg8000 in the URL example with one sentence on why.

Validation contract

Machine-observable: the flows suite passes in a venv holding pg8000 1.31.5 with no psycopg installed (709 passed, 12 skipped — only URL strings moved in the tests); translate_pg8000_url over ?sslmode=require&application_name=x and ?sslmode=disable gives sslmode stripped, application_name kept, ssl_context present / False; git grep psycopg over core/flows, deploy and docs (excluding the changelog and admin-api) returns nothing; helm template on the flows tier renders postgresql+pg8000:// and calls the translator in all three bootstrap blocks; the fast static gates green. Caller-verified before merge, on a host with Postgres: a live round trip through pg8000 — the bootstrap creates the database, the schema converges, and a worker claims one step — plus the admin-api testcontainers run.

Out of scope: any other Category-X dependency (the sharp optionals in the Terminal and bot images are their own issue); changing the flows schema or engine behaviour; removing psycopg from admin-api's test path.

Refs: business custody DmitriyG228/biz#451 — the FINOS license and CVE report, 2026-09-18. Delivered by #1712.