TX-SQL2: record production composition boundary

[coenttb]

Refs #6

UNVERIFIED. Exact draft head: 36ae0c855280cf09f87ba940f5fc6dce1da2cfdd.

This draft composes PostgreSQL production transport, bounded ownership, and escaping cursors directly from public Institute owners. Exact source contracts: SQL e9d44cba50fccac90c8c751b0fa95b100aa7e9c8, Pool Primitives b7c710c945b7c8467b4521c3a2d5b00539275593, TLS e27e99f5c841170593dde7b0396e9090a7515f62, DNS 930ab8b5dadc99d6c44b101d92422545b697db7d, Byte Channel dfc56d1ed173aae4db784018c746050cbfbe4ee7, and Sockets 3fad32626d347cbfc0e803496e7ad9c0e66162db.

The provider owns public Pool.Bounded<Session<Transport>> directly. Scoped read/write/rollback operations retain the existing law: one sending move-only handle remains in the database actor, active success resolves reusable, and failure or cancellation resolves invalid.

SQL Reader now owns the sole actor-to-caller cursor transfer seam. Postgres.Database.cursor checks out exactly one handle, opens the PostgreSQL portal through its borrowed session, and consumes that same handle into SQL's generic move-only, non-Sendable Cursor context. Each successful advance returns the only continuation. Natural exhaustion and successful explicit portal close resolve the handle reusable. Open, iteration, decoding, portal-close, or cancellation failure resolves it invalid. Dropping a live Cursor synchronously discards the handle into Pool's abandon/drop path. SQL.Connection.fetchCursor is removed because scoped connections no longer own cursor acquisition.

There is no second checkout, provider-local Cursor/context box, lifecycle gate, public with*, Task cleanup, Error-carried resource, copied lifecycle closure, SPI, trait, unchecked conformance, compatibility Lease facade, or new habitual @Sendable requirement.

Transport ownership is unchanged: one nonoptional TLS.Peer.Identity drives DNS and TLS, typed Index<Byte>.Count / Byte.Chunk cross the TLS membrane, and the sending non-Sendable TLS Session is consumed into actor isolation. Event-backed IO, Byte.Channel<TLS.Failure>.pair, the total Sockets.Error → TLS.Failure mapper, Sockets-owned Writer outcome adaptation, and Session → Pump → runner close ordering remain.

Changed paths at this head: Package.swift, Sources/SQL Postgres Provider/Postgres.Provider.Database.swift, Sources/SQL Postgres Provider/Postgres.Provider.Connection.swift, Sources/SQL Postgres Provider/Postgres.Provider.Session.swift, Tests/SQL Postgres Provider Tests/Postgres.Provider.Production.Contracts.swift, README.md, and Documentation/Production scenarios.md. No Pool Primitives, TLS, Sockets, DNS, workflow, or Package.resolved path changed.

No build, test, resolve, update, clean, run, compose, verification, typecheck, lint, compiler probe, or CI read/watch/poll was performed under the source-only moratorium.