BUZZ-175: Add application-owned writer lock foundations (#7706)

## Summary

Buzz is moving database invariants from triggers and foreign keys into
application-owned transaction protocols. This PR adds the first
transition foundations while preserving all current database backstops.

- Add a shared community-write lock for single-community writer
transactions, and make deletion lifecycle transitions take the matching
exclusive lock. A supported serving transaction never spans communities.
- Add shared event-writer and exclusive replica-probe lock ordering
around the existing heartbeat publication model.
- Document the supported writer contract, reviewed backfill path, and
transition gates.
- Keep one replica-floor publication concept and remove an unrelated
reconciliation-script edit found during review. This narrows the change
rather than adding parallel protocols.

The blast radius is limited to new opt-in writer helpers plus lock
acquisition in deletion and replica probing. Existing trigger and GUC
enforcement remains authoritative, so callers can migrate in later pull
requests.

### Related issue

[BUZZ-175](https://linear.app/squareup/issue/BUZZ-175). This is the
first implementation slice from the OSC migration plan.

### Testing

No manual testing. CI covers the Rust checks and database tests added
here.

Generated with [Codex](https://openai.com/codex)

---------

Signed-off-by: tornquist <tornquist@squareup.com>
Co-authored-by: Codex <noreply@openai.com>

scripts/cutover/README.md

@@ -19,6 +19,23 @@ Only when upgrading a Postgres that already holds **pre-1321 single-community
 data** to 1321. A brand-new deployment does **not** run this — it provisions
 from `migrations/0001_initial_schema.sql` (or `schema/schema.sql`) directly.
 
+## Supported writer contract during transition
+
+Outside this one-off cutover, direct owner SQL mutation is not a supported
+steady-state path unless explicitly reviewed.
+
+- Reviewed backfills and reconciliations should use relay-owned transaction and
+  lock protocols where they exist (one community fence per transaction and
+  replica-floor shared/exclusive lock ordering).
+- If a workflow cannot use those protocols yet, execute it under an explicitly
+  reviewed procedure that keeps replica routing fences closed for the run.
+- Existing trigger/function backstops remain the commit-time authority during
+  this transition. Their removal requires separate coverage and fleet gates;
+  this cutover does not authorize it.
+- Role separation is deliberate: schema reconciliation scripts carry schema
+  convergence only; serving admission/fencing semantics remain in runtime/store
+  code paths with startup verification and metrics.
+
 ## Preconditions
 
 - The DB is pristine pre-1321: no `communities` table, no `community_id`