feat: Phase 2 — ports package, secrets port move, postgres adapter move

Problem: the hexagon's Phase 2 (plans/2026-08-15-hexagonal-architecture.md)
must give the use-cases-to-be their contract surface: driven-port
interfaces, test fakes, the secrets interface moved into core, and the
postgres package inside the adapters tree — before the first vertical
slice (Phase 3) can wire a composition root.

Change:
- internal/core/ports: full driven-port catalog per plan §3.3 —
  repositories as transaction-scoped aggregates whose inputs carry
  derived checks, audit, and events (§3.6), plus CommandExecutor,
  TargetResolver, Checker, Secrets, EventPublisher, Provisioner.
  Port-local payload types (Event, AuditEntry, CheckDef, KnowledgeEntry,
  ExecResult) keep signatures off infrastructure; TypeTree aliases
  internal/ontology (pure over domain) until checkdefaults is absorbed.
  ReadModels intentionally not declared yet — it materializes with the
  Phase 3 slice and grows as report handlers rewire.
- secrets.Backend is now an alias of ports.Secrets; implementations
  (Infisical, SOPS, Manager) unchanged. mcp's local secretBackend
  subset is deleted; tool constructors take ports.Secrets.
- internal/db → internal/adapters/postgres (mechanical import rewrite;
  package identifier stays db until the Phase 3 repository split).
  sqlc.yaml, Makefile, golangci exclusions, and docs follow the move;
  make generate-check verified.
- internal/adapters/ssh: Executor implements ports.CommandExecutor over
  the actuator dial pool + RunStreaming (10-min default timeout carried
  over from the httpapi path).
- internal/adapters/remote: Resolver implements ports.TargetResolver
  delegating to internal/remote (still pool-based; drops onto
  ports.EntityRepository when repositories land in Phase 3 — documented
  transitional import).
- internal/core/ports/portstest: importable fakes — in-memory
  EntityRepo (with check-then-act SetState, side-effect recording),
  RecordingExecutor, FakeChecker, SpyPublisher; port-satisfaction
  guards; tests.

Risk: ports are declared ahead of implementations — signatures firm up
per phase as slices land (documented in the package doc); the
remote→postgres transitional import is explicit and dissolves in
Phase 3.

Verification: go vet, make test (race, 19 packages), generate-check,
golangci on core+adapters — 0 issues; full-repo baseline down
365→344.

internal/core/ports/governance.go

@@ -0,0 +1,97 @@
+package ports
+
+import (
+	"context"
+	"time"
+
+	"github.com/dtoro/oikos/internal/core/domain"
+)
+
+// SignalUpsertInput is the observe-pass signal write: open/resolve
+// transitions with their triggers, committed atomically.
+type SignalUpsertInput struct {
+	Signal   domain.Signal
+	Triggers []SignalTrigger
+	Audit    []AuditEntry
+	Event    *Event
+}
+
+// SignalTrigger is an automatic follow-up fired on a signal transition
+// (payload firm; shapes firm up with the Phase 5 observation slice).
+type SignalTrigger struct {
+	Kind       string
+	EntityID   domain.UUID
+	Parameters map[string]any
+}
+
+// SignalTransitionInput acks/resolves/mutes a signal (check-then-act on the
+// signal's current state inside the transaction).
+type SignalTransitionInput struct {
+	SignalID domain.UUID
+	Action   string // "ack", "resolve", "mute"
+	Note     string
+	MuteFor  time.Duration
+	Actor    string
+	Audit    []AuditEntry
+	Event    *Event
+}
+
+// SignalRepository is the signal aggregate.
+type SignalRepository interface {
+	Open(ctx context.Context) ([]domain.Signal, error)
+	History(ctx context.Context, entityID domain.UUID, limit int) ([]domain.Signal, error)
+
+	UpsertWithTriggers(ctx context.Context, input SignalUpsertInput) error
+	Transition(ctx context.Context, input SignalTransitionInput) (domain.Signal, error)
+}
+
+// ExecutionSubmitInput is the queued-execution write: execution row,
+// approval (for gated risk classes), audit, and event — one transaction.
+type ExecutionSubmitInput struct {
+	Execution domain.Execution
+	Approval  *domain.Approval
+	Audit     []AuditEntry
+	Event     *Event
+}
+
+// ExecutionCompleteInput closes out an execution: final status, output
+// summary, audit, event.
+type ExecutionCompleteInput struct {
+	ExecutionID domain.UUID
+	Status      string
+	Output      string
+	ExitCode    int
+	Audit       []AuditEntry
+	Event       *Event
+}
+
+// ExecutionRepository is the execution aggregate. Claim uses an advisory
+// lock so exactly one worker claims a queued execution.
+type ExecutionRepository interface {
+	List(ctx context.Context, cursor string, limit int) ([]domain.Execution, error)
+	ReadLog(ctx context.Context, executionID domain.UUID) ([]string, error)
+
+	SubmitQueued(ctx context.Context, input ExecutionSubmitInput) (domain.Execution, error)
+	Claim(ctx context.Context) (*domain.Execution, error)
+	AppendLog(ctx context.Context, executionID domain.UUID, chunk string) error
+	Complete(ctx context.Context, input ExecutionCompleteInput) error
+}
+
+// ApprovalDecideInput verifies the HMAC token (check-then-act), flips the
+// approval, un-gates the execution, and appends audit — one transaction.
+// Double-approve must not double-execute.
+type ApprovalDecideInput struct {
+	ApprovalID domain.UUID
+	Token      string
+	Approved   bool
+	Actor      string
+	Audit      []AuditEntry
+	Event      *Event
+}
+
+// ApprovalRepository is the approval aggregate.
+type ApprovalRepository interface {
+	ListPending(ctx context.Context, entityID domain.UUID, limit int) ([]domain.Approval, error)
+
+	Decide(ctx context.Context, input ApprovalDecideInput) (domain.Approval, error)
+}