oikos phase 0: ontology + inventory + policy seeds, OpenAPI contract, ADRs

- seeds/ontology.yaml: 59 entity types (5 abstract, is-a hierarchy), 46
  relationship types with cardinality, 6 lifecycles with terminal states
  and named precondition checks
- seeds/inventory.yaml: 110 entities / 142 relationships translated from
  legacy inventory.yaml (fleet, services, ingress, storage, governance,
  archaeology); thin spots marked for backfill
- seeds/policy.yaml: 4 risk classes, 27 approval rules (hierarchy-aware,
  per-entity overrides), autonomy kill-switch off (cold start)
- api/openapi.yaml: full v1 REST contract (40 paths), RFC 9457 errors,
  cursor pagination, idempotency, ETag/If-Match, scopes; redocly-clean
- docs/adr/0001-0010: initial architecture decision records
- scripts/validate-seeds.py: Phase 0 gate — hierarchy, lifecycles,
  endpoints, cardinality, policy cross-refs (0 errors)
- plan: layer CHECK gains 'meta' (root type), cardinality gains
  'many-to-one'

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/adr/0002-postgres-timescale-only-datastore.md

@@ -0,0 +1,25 @@
+# ADR 0002 — PostgreSQL + TimescaleDB as the only datastore
+
+Status: accepted (2026-07-07) · Plan: rev 3
+
+## Context
+The OS needs a graph (entities/relationships), operational tables
+(signals/executions/approvals), a learning corpus, time-series metrics,
+audit and event logs. Alternatives: dedicated graph DB (Neo4j), dedicated
+TSDB (Prometheus/VictoriaMetrics), or one Postgres.
+
+## Decision
+One PostgreSQL 16 instance with the TimescaleDB extension
+(timescale/timescaledb:2-pg16). Graph traversal via recursive CTEs
+(cycle-safe blast_radius); time-series via hypertables + continuous
+aggregates + retention policies; events via table + LISTEN/NOTIFY.
+
+## Consequences
+- One backup/restore/DR story, one connection pool, transactional
+  consistency between graph and operational writes (e.g. event emission in
+  the same transaction as state change).
+- Postgres is the accepted SPOF — mitigated by daily pg_dump + WAL PITR +
+  off-host copies + monthly restore drills; streaming replication is the
+  future path if needed.
+- Homelab graph scale (hundreds of nodes) is far below where a dedicated
+  graph DB pays for itself.