Pin PostgreSQL by digest and mirror it to GHCR

[SaladDay]

What

• One home for the PostgreSQL pin: deploy/compose/database-image.txt holds the official postgres:16-alpine@sha256:721873c3… multi-platform index (16.15-alpine3.24, re-verified against Docker Hub; its amd64 child is 1a66d744…, the digest the bundle already pinned).
• deploy/compose/compose.yaml takes __OAC_DATABASE_IMAGE__; scripts/render-compose.py exposes DATABASE_PIN and renders the release value.
• Release: scripts/publish-core-release.py copies that index with docker buildx imagetools create to ghcr.io/<repo>/postgres:<version>, keeps all platforms and the digest, refuses a tag that names another digest, and the release compose.yaml pins ghcr.io/<repo>/postgres@sha256:721873c3….
• Offline bundle: build-core-distribution.sh resolves the linux/amd64 child from the pin (no second digest); install-source.py fills the template token like the other images.
• Smoke renders the upstream pin; ci_plan.py selects the compose jobs for the new .txt.
• Docs (EN + zh, source_hash refreshed): every image comes from GHCR, Docker Hub not needed; maintainers describe the pin and the mirrored postgres component.

Why

Audit-core finding 3 and section 7: floating Docker Hub tag, never refreshed on upgrade, two pins, unreachable from some hosts (mx); user decision 2.

Upgrade

oac install --upgrade and install.py --upgrade render the new release compose.yaml; config --images lists the new digest, it is pulled from GHCR, and up recreates the database container on the same named volume. The pin file test and the bundle's PostgreSQL 16 check keep the major version fixed.

Verification

• deploy/compose/test_compose.py, deploy/test_install_source.py, scripts/publish-core-release.test.py (39), scripts/core-distribution-manifest.test.py, scripts/ci_plan_test.py: pass.
• scripts/check-names.py: pass. node --test website/tests/translations.test.mjs: 1-2 pass, test 3 skipped (vitepress not installed here).
• Mirror command pinned by a unit test (no push from this host).

Not run: compose-smoke.py (needs Docker Hub; CI compose job covers it), a real imagetools create against GHCR.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}