feat: Core's Module Database ABI v1 executor, proven against PostgreSQL (ADR 0050)

Implements the first ADR 0050 slice: Core's ORM-neutral executor and its
PostgreSQL evidence. Nothing is wired to modules yet; manifest v8, SDK
adapters, schema metadata, packaging, and Signage are later slices. The
legacy ModuleDatabase facade is unchanged.

Contracts (@ekklesia/contracts, no imports at all):
- ABI version 1; query { text, values, rowMode } returning
  { command, rowCount, rows, fields: [{ name, typeOid }] };
- executor, transaction, and savepoint types with exactly the ABI's
  members; parameter and result value types;
- ModuleDatabaseError { code, sqlState? }: eight stable codes, and a
  SQLSTATE only when PostgreSQL supplied one; static messages, no cause,
  frozen; isModuleDatabaseError recognises it by shape.

Core (createModuleDatabaseExecutor over the API's existing pool):
- one statement per query, enforced by forcing the extended query
  protocol so PostgreSQL itself refuses a second statement (42601);
  no SQL parsing;
- parameters: null, boolean, number, bigint, string, Uint8Array, and
  rectangular arrays of them; everything else refused before sending;
- a Core-owned decoding table that never consults pg's global parser
  registry: int8, numeric, temporal, and JSON as exact text; bytea as a
  plain Uint8Array; built-in arrays element by element;
- every operation pins TimeZone, DateStyle, IntervalStyle, bytea_output,
  and extra_float_digits, then resets with DISCARD ALL before returning
  the connection, or destroys it when it cannot be reset cleanly;
- callback-scoped transactions with explicit isolation and access mode;
  a COMMIT that PostgreSQL answers with ROLLBACK is reported as failed;
- savepoints named by Core; only the innermost scope is active; scopes
  are revoked when their callback settles;
- a callback that settles with work outstanding is rolled back, never
  committed or released;
- transaction-control statements sent through query are refused by
  command tag and transaction status, and fail the transaction;
- the module ID is carried for Core's attribution only.

Tests:
- 83 integration tests on a database with hostile defaults: queries,
  the one-statement rule, parameters, decoding, errors, transactions,
  savepoints, forgotten awaits, pool safety after every failure class,
  and session state;
- unit tests for encoding, decoding, options, sanitization, and scope
  bookkeeping;
- type-level and source checks that no ORM or driver object crosses
  the boundary.

ADR 0050 is Accepted.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/architecture/decisions/0050-module-database-abi-v1.md

@@ -1,6 +1,6 @@
 # 0050: Module Database ABI v1: modules and Core exchange SQL, never ORM objects
 
-- Status: Proposed
+- Status: Accepted
 - Date: 2026-10-07
 - Supersedes (partial): [0016](0016-module-database-access.md) — for modules that declare ABI v1,
   only its definition of the module database service as `Pick<NodePgDatabase, …>`, a facade over

docs/architecture/decisions/README.md

@@ -58,4 +58,4 @@ ADRs capture durable choices that affect more than one package or phase.
 - [0047: Every module proves itself inside Ekklesia, with one harness the platform publishes](0047-module-ci-harness.md) — Proposed
 - [0048: Ekklesia ships one generic image, and installed modules live outside it](0048-generic-image-and-installed-module-storage.md) — Accepted
 - [0049: A module release is one immutable, self-contained package: Ekklesia Module Package v1](0049-module-package-v1.md) — Accepted
-- [0050: Module Database ABI v1: modules and Core exchange SQL, never ORM objects](0050-module-database-abi-v1.md) — Proposed
+- [0050: Module Database ABI v1: modules and Core exchange SQL, never ORM objects](0050-module-database-abi-v1.md) — Accepted

docs/architecture/platform-architecture.md

@@ -686,5 +686,7 @@ Module Package v1, a deterministic `.tar.gz` with its SHA-256.
   and loads the backend once in a short-lived process with an empty environment. Only then does it
   extract anything.
 - **What exists today.** Only the `any` target. Drizzle agreement is recorded as transitional, not a
-  database ABI. [ADR 0050](decisions/0050-module-database-abi-v1.md), still proposed, defines the
-  Module Database ABI that removes it for modules that declare that ABI.
+  database ABI. [ADR 0050](decisions/0050-module-database-abi-v1.md) defines the Module Database ABI
+  that removes it for modules that declare that ABI. Core's ABI v1 executor
+  (`createModuleDatabaseExecutor`) exists and is proven against PostgreSQL. No module can declare the
+  ABI or receive the executor yet: that needs manifest version 8.