feat: Phase 2 — ports package, secrets port move, postgres adapter move

Problem: the hexagon's Phase 2 (plans/2026-08-15-hexagonal-architecture.md)
must give the use-cases-to-be their contract surface: driven-port
interfaces, test fakes, the secrets interface moved into core, and the
postgres package inside the adapters tree — before the first vertical
slice (Phase 3) can wire a composition root.

Change:
- internal/core/ports: full driven-port catalog per plan §3.3 —
  repositories as transaction-scoped aggregates whose inputs carry
  derived checks, audit, and events (§3.6), plus CommandExecutor,
  TargetResolver, Checker, Secrets, EventPublisher, Provisioner.
  Port-local payload types (Event, AuditEntry, CheckDef, KnowledgeEntry,
  ExecResult) keep signatures off infrastructure; TypeTree aliases
  internal/ontology (pure over domain) until checkdefaults is absorbed.
  ReadModels intentionally not declared yet — it materializes with the
  Phase 3 slice and grows as report handlers rewire.
- secrets.Backend is now an alias of ports.Secrets; implementations
  (Infisical, SOPS, Manager) unchanged. mcp's local secretBackend
  subset is deleted; tool constructors take ports.Secrets.
- internal/db → internal/adapters/postgres (mechanical import rewrite;
  package identifier stays db until the Phase 3 repository split).
  sqlc.yaml, Makefile, golangci exclusions, and docs follow the move;
  make generate-check verified.
- internal/adapters/ssh: Executor implements ports.CommandExecutor over
  the actuator dial pool + RunStreaming (10-min default timeout carried
  over from the httpapi path).
- internal/adapters/remote: Resolver implements ports.TargetResolver
  delegating to internal/remote (still pool-based; drops onto
  ports.EntityRepository when repositories land in Phase 3 — documented
  transitional import).
- internal/core/ports/portstest: importable fakes — in-memory
  EntityRepo (with check-then-act SetState, side-effect recording),
  RecordingExecutor, FakeChecker, SpyPublisher; port-satisfaction
  guards; tests.

Risk: ports are declared ahead of implementations — signatures firm up
per phase as slices land (documented in the package doc); the
remote→postgres transitional import is explicit and dissolves in
Phase 3.

Verification: go vet, make test (race, 19 packages), generate-check,
golangci on core+adapters — 0 issues; full-repo baseline down
365→344.

internal/adapters/postgres/sqlcgen/models.go

@@ -0,0 +1,460 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.29.0
+
+package sqlcgen
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type AgentActivity struct {
+	ID            int64
+	Ts            time.Time
+	AgentID       uuid.UUID
+	SessionID     *string
+	ActivityType  string
+	ToolName      *string
+	EntityID      *uuid.UUID
+	InputSummary  *string
+	OutputSummary *string
+	DurationMs    *int32
+	TokenCount    *int32
+	Success       *bool
+	CorrelationID *string
+}
+
+type AgentMessage struct {
+	ID        uuid.UUID
+	SessionID uuid.UUID
+	Role      string
+	Content   []byte
+	CreatedAt time.Time
+}
+
+type AgentSession struct {
+	ID               uuid.UUID
+	Title            string
+	Actor            string
+	CreatedAt        time.Time
+	LastActiveAt     time.Time
+	Goal             string
+	Status           string
+	Outcome          *string
+	Summary          string
+	EntityID         *uuid.UUID
+	CompletionNudges int32
+	Blocker          string
+	ClosedAt         *time.Time
+}
+
+type Approval struct {
+	EntityID        uuid.UUID
+	SubjectEntityID *uuid.UUID
+	Action          string
+	RiskClass       string
+	Kind            string
+	Payload         []byte
+	Status          string
+	TokenHash       *string
+	ExpiresAt       time.Time
+	DecidedAt       *time.Time
+	DecidedBy       *uuid.UUID
+	CreatedAt       time.Time
+	MatrixEventID   *string
+	AlertSentAt     *time.Time
+}
+
+type ApprovalRule struct {
+	ID            uuid.UUID
+	EntityType    *string
+	Action        string
+	RiskClass     string
+	AutonomyLevel string
+	ScopeEntity   *uuid.UUID
+	Version       int32
+	UpdatedAt     time.Time
+}
+
+type AuditLog struct {
+	ID            int64
+	Ts            time.Time
+	ActorType     string
+	ActorID       *uuid.UUID
+	Action        string
+	EntityID      *uuid.UUID
+	Method        *string
+	Path          *string
+	StatusCode    *int32
+	Detail        []byte
+	SourceIp      *string
+	CorrelationID *string
+	SessionID     *uuid.UUID
+}
+
+type AutonomySetting struct {
+	Key       string
+	Value     string
+	Version   int32
+	UpdatedAt time.Time
+}
+
+type CheckDef struct {
+	EntityID   uuid.UUID
+	TargetID   *uuid.UUID
+	TargetType *string
+	Kind       string
+	Config     []byte
+	IntervalS  int32
+	TimeoutS   int32
+	Zone       *string
+	Enabled    bool
+	UpdatedAt  time.Time
+	// When this check last executed. NULL = never, due immediately. Compared against interval_s to decide due-ness.
+	LastRunAt *time.Time
+	// This check's own most recent verdict (healthy/degraded/down/unknown). entity_status.health is the worst of these across the target's enabled checks.
+	LastHealth *string
+}
+
+type Classification struct {
+	EntityID          uuid.UUID
+	SignalEntityID    *uuid.UUID
+	TargetEntityID    *uuid.UUID
+	Action            string
+	RecommendedAction []byte
+	RiskClass         string
+	Route             string
+	BlastRadius       []uuid.UUID
+	PatternConfidence *float32
+	SkillID           *uuid.UUID
+	AutonomyCheck     *string
+	Reasoning         []byte
+	CorrelationID     string
+	CreatedAt         time.Time
+}
+
+type ContextFile struct {
+	Path        string
+	Hash        string
+	LastChanged time.Time
+}
+
+type ContextVersion struct {
+	Singleton bool
+	Version   int64
+	UpdatedAt time.Time
+}
+
+type Entity struct {
+	ID               uuid.UUID
+	Slug             string
+	Type             string
+	Name             string
+	State            *string
+	Attributes       []byte
+	MaintenanceUntil *time.Time
+	Version          int32
+	CreatedAt        time.Time
+	UpdatedAt        time.Time
+	EnrolledAt       *time.Time
+	EnrolledBy       *uuid.UUID
+}
+
+type EntityStatus struct {
+	EntityID    uuid.UUID
+	Health      string
+	LastCheckAt *time.Time
+	Details     []byte
+	UpdatedAt   time.Time
+}
+
+type EntityType struct {
+	Name            string
+	ParentType      *string
+	IsAbstract      bool
+	Domain          string
+	Layer           string
+	Description     *string
+	LifecycleID     *string
+	AttributeSchema []byte
+	SchemaVersion   int32
+	Status          string
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+	// Check kinds this type warrants, resolved through parent_type. NULL means undeclared (an ontology gap), [] means explicitly unmonitorable, ["http","resource"] means declared kinds. Populated from seeds/ontology.yaml.
+	MonitoringSpec []byte
+}
+
+type Event struct {
+	ID            int64
+	Ts            time.Time
+	Type          string
+	EntityID      *uuid.UUID
+	Severity      string
+	Source        string
+	Data          []byte
+	CorrelationID *string
+}
+
+type Execution struct {
+	EntityID         uuid.UUID
+	ClassificationID *uuid.UUID
+	SignalEntityID   *uuid.UUID
+	TargetEntityID   *uuid.UUID
+	Action           string
+	RiskClass        string
+	ApprovalID       *uuid.UUID
+	AgentID          *uuid.UUID
+	SkillID          *uuid.UUID
+	SkillVersion     *int32
+	Status           string
+	Result           []byte
+	DurationMs       *int32
+	Verified         bool
+	CorrelationID    string
+	StartedAt        *time.Time
+	CompletedAt      *time.Time
+	CreatedAt        time.Time
+}
+
+type ExecutionLog struct {
+	ExecutionID uuid.UUID
+	Ts          time.Time
+	Seq         int32
+	Stream      string
+	Chunk       string
+}
+
+type Feedback struct {
+	EntityID              uuid.UUID
+	ExecutionID           uuid.UUID
+	Outcome               string
+	Observation           *string
+	Lesson                *string
+	UnexpectedSideEffects []string
+	Tags                  []string
+	CreatedAt             time.Time
+}
+
+type IdempotencyKey struct {
+	Key          string
+	Actor        string
+	RequestHash  string
+	ResponseCode *int32
+	ResponseBody []byte
+	CreatedAt    time.Time
+}
+
+type KnowledgeEntity struct {
+	EntityID    uuid.UUID
+	Title       string
+	Content     string
+	Source      *string
+	Tags        []string
+	CreatedAt   time.Time
+	UpdatedAt   time.Time
+	ContentHash *string
+	Search      interface{}
+	EditedBy    string
+	DeletedAt   *time.Time
+}
+
+type KnowledgeRevision struct {
+	ID        int64
+	EntityID  uuid.UUID
+	Title     string
+	Content   string
+	Source    *string
+	Tags      []string
+	EditedBy  string
+	VersionAt time.Time
+	RevisedAt time.Time
+}
+
+type Ledger struct {
+	Ts             time.Time
+	ExecutionID    uuid.UUID
+	TargetEntityID *uuid.UUID
+	Action         string
+	RiskClass      string
+	Status         string
+	Verified       bool
+	Route          *string
+	Reasoning      []byte
+	ApprovalStatus *string
+	DecidedBy      *uuid.UUID
+	AgentID        *uuid.UUID
+	CorrelationID  string
+}
+
+type LifecycleDef struct {
+	ID             string
+	States         []string
+	DefaultState   string
+	TerminalStates []string
+	Transitions    []byte
+	CreatedAt      time.Time
+}
+
+type MetricRollups1d struct {
+	Bucket      interface{}
+	EntityID    uuid.UUID
+	Metric      string
+	AvgValue    float64
+	MinValue    interface{}
+	MaxValue    interface{}
+	SampleCount int64
+}
+
+type MetricRollups1h struct {
+	Bucket      interface{}
+	EntityID    uuid.UUID
+	Metric      string
+	AvgValue    float64
+	MinValue    interface{}
+	MaxValue    interface{}
+	SampleCount int64
+}
+
+type MetricSample struct {
+	Ts       time.Time
+	EntityID uuid.UUID
+	Metric   string
+	Value    float64
+	Tags     []byte
+}
+
+type NomosPlanExecution struct {
+	ExecutionID uuid.UUID
+	SessionID   uuid.UUID
+	ContinuedAt *time.Time
+	CreatedAt   time.Time
+}
+
+type Pattern struct {
+	EntityID        uuid.UUID
+	AppliesType     string
+	Action          string
+	Pattern         string
+	Confidence      float32
+	EvidenceCount   int32
+	SuccessCount    int32
+	FailureCount    int32
+	Status          string
+	Quarantined     bool
+	Version         int32
+	LastValidatedAt *time.Time
+	CreatedAt       time.Time
+}
+
+type ProvisioningStep struct {
+	ID           uuid.UUID
+	EntityID     uuid.UUID
+	ExecutionID  uuid.UUID
+	StepOrder    int32
+	StepName     string
+	Status       string
+	StartedAt    *time.Time
+	FinishedAt   *time.Time
+	ErrorMessage *string
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}
+
+type Relationship struct {
+	SourceID   uuid.UUID
+	TargetID   uuid.UUID
+	Type       string
+	Attributes []byte
+	ValidFrom  time.Time
+	ValidTo    *time.Time
+}
+
+type RelationshipType struct {
+	Name        string
+	Inverse     *string
+	SourceType  string
+	TargetType  string
+	Cardinality string
+	Description *string
+	CreatedAt   time.Time
+	// Which end of this edge depends on the other. forward = target depends on source. backward = source depends on target. none = no runtime dependency. Drives blast_radius().
+	BlastDirection string
+}
+
+type RiskClass struct {
+	Name             string
+	Description      *string
+	ApprovalRequired string
+	AutonomyAllowed  bool
+}
+
+type SeedVersion struct {
+	File        string
+	ContentHash string
+	AppliedAt   time.Time
+}
+
+type SessionPlanStep struct {
+	ID             uuid.UUID
+	SessionID      uuid.UUID
+	Seq            int32
+	Title          string
+	Detail         string
+	Status         string
+	ExecutionID    *uuid.UUID
+	TargetSlug     *string
+	StartedAt      *time.Time
+	FinishedAt     *time.Time
+	CreatedAt      time.Time
+	Generation     int32
+	ReplacedReason *string
+}
+
+type SessionQuestion struct {
+	ID         uuid.UUID
+	SessionID  uuid.UUID
+	Prompt     string
+	Context    []byte
+	Status     string
+	Answer     *string
+	CreatedAt  time.Time
+	AnsweredAt *time.Time
+}
+
+type Signal struct {
+	EntityID        uuid.UUID
+	Kind            string
+	Severity        string
+	TargetEntityID  *uuid.UUID
+	CheckID         *uuid.UUID
+	Evidence        *string
+	LikelyCause     *string
+	State           string
+	OccurrenceCount int32
+	FirstSeenAt     time.Time
+	LastSeenAt      time.Time
+	FlapCount       int32
+	HoldDownUntil   *time.Time
+	MuteUntil       *time.Time
+	CreatedAt       time.Time
+	UpdatedAt       time.Time
+}
+
+type Skill struct {
+	EntityID     uuid.UUID
+	Version      int32
+	Name         string
+	Procedure    []byte
+	AppliesType  *string
+	Action       string
+	PatternIds   []uuid.UUID
+	Status       string
+	SuccessRate  *float32
+	ChangedBy    *uuid.UUID
+	ChangeReason *string
+	LastUsedAt   *time.Time
+	CreatedAt    time.Time
+}