test: validate M3 imports and locking on PostgreSQL

Add isolated PostgreSQL fixtures, two-session locking coverage, and a disposable remote Docker test runner. Correct the canonical-root fixture and document verified SQLite and PostgreSQL results.

bin/test-postgres.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+# Run from an isolated checkout on any Docker host. No existing database is touched.
+set -eu
+cd "$(dirname "$0")/.."
+suffix="$$-$(date +%s)"
+network="meshvault-test-$suffix"
+database="meshvault-test-db-$suffix"
+image="meshvault-test:$suffix"
+runner="meshvault-test-runner-$suffix"
+cleanup() {
+    docker rm -f "$runner" >/dev/null 2>&1 || true
+    docker rm -f "$database" >/dev/null 2>&1 || true
+    docker network rm "$network" >/dev/null 2>&1 || true
+    docker image rm "$image" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+docker build -f docker/php/Dockerfile.test -t "$image" .
+docker network create "$network" >/dev/null
+# Password is disposable, on a dedicated network, with no published port or persistent volume.
+docker run -d --rm --name "$database" --network "$network" \
+    -e POSTGRES_USER=meshvault_test -e POSTGRES_DB=meshvault_test \
+    -e POSTGRES_PASSWORD=disposable-test-only postgres:17-bookworm >/dev/null
+attempt=0
+until docker exec "$database" pg_isready -h 127.0.0.1 -U meshvault_test -d meshvault_test >/dev/null 2>&1; do
+    attempt=$((attempt + 1))
+    if [ "$attempt" -ge 60 ]; then
+        echo 'PostgreSQL did not become ready' >&2
+        exit 1
+    fi
+    sleep 1
+done
+docker run --rm --name "$runner" --network "$network" \
+    -e MESHVAULT_TEST_PG_DSN="pgsql:host=$database;dbname=meshvault_test" \
+    -e MESHVAULT_TEST_PG_USER=meshvault_test \
+    -e MESHVAULT_TEST_PG_PASSWORD=disposable-test-only \
+    "$image" composer test
+docker run --rm --name "$runner" "$image" composer lint
+echo 'PostgreSQL tests and lint completed successfully.'