Review rework for the insert-time created_at floor (BUZZ-316 phase 1).
- Ordinary and thread event writers now run the floor check after their
ON CONFLICT DO NOTHING INSERT, only when a row was inserted and before
follow-ups. Replaying an already-stored id stays Duplicate even when
its created_at has aged below the floor, matching the trigger.
- Source policy: UPDATE rule catches ONLY, aliases and row-constructor
column lists; quoted identifiers are normalized; the floor policy
scans every crate's src via the shared workspace walk.
- NIP-43 membership insert writes a literal NULL channel_id, pinned
positionally; the bind-based exemption is gone.
- Canvas CAS fixtures take a per-test base instead of a process-wide
OnceLock.
- seed-admin-dashboard.sh also refuses PGHOSTADDR, PGSERVICE and
multi-host PGHOST.
Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
a31c0aad56