[FEATURE] Bundled Postgres creates its own database identities at startup #3677

Implements the database identity contract (#3184) for bundled Postgres. The Postgres pod runs the idempotent identity SQL from its postStart hook, so no install path has to exec into the pod.

Tracks "Let bundled Postgres create its own identities" in the Publish the install as kustomize bases workstream of the Extensible Install Roadmap.

Current state (0b635b80)

• The postStart hook in manifests/ate-install/postgres/postgres.yaml only runs createdb.
• ate-setup runs psql via kubectl exec (cmd/ate-setup/internal/steps/postgres.go). This needs the pods/exec permission.
• The SQL exists in pkg/postgressetup/setup.sql.

Required changes

• Render setup.sql into the Postgres ConfigMap with the fixed bundled values.
• Run it from postStart on every start.
• Remove the exec step and the pods/exec permission from ate-setup.
• External databases are unchanged: operators or substrate-gke run the same SQL once with their own values.

Dependencies: none.

Enforcement

• The existing pkg/postgressetup tests.
• A kind test restarts the Postgres pod and asserts the hook succeeds again.
• ate-setup RBAC has no pods/exec.

Parent Issue: #3169