Exercise PostgreSQL ClickPipe creation through the CLI in live CI

[sdairs]

Summary

• invoke the workflow-built clickhousectl binary for both PostgreSQL ClickPipe creation attempts
• assert the private-CA attempt without --ca-certificate preserves the x509 API error, then write the fetched CA and create successfully
• retain isolated tagged services, API-driven polling and cleanup, Running-state validation, initial snapshot, and ongoing CDC checks
• isolate CLI state in a temporary home/workspace and document the missing publicly trusted PostgreSQL fixture

Verification

• cargo build -p clickhousectl
• cargo test -p clickhouse-cloud-api --test clickpipe_postgres_cdc_test --no-run
• cargo test --workspace
• python3 -m unittest discover -s scripts/tests -p 'test_*.py' (43 passed)
• python3 scripts/classify-cloud-integration.py issue-446-clickpipe-tls-guidance-v2 HEAD (service,postgres,organization,clickpipes; workflow guard selects all)
• cargo fmt --all --check
• cargo clippy --workspace --all-targets -- -D warnings
• credentialed Cloud Integration run 32751122188 (passed all four mandatory suites)

Live Test Status

Passed in credentialed CI. The CLI-backed PostgreSQL test verified the private-CA error without the flag, successful creation with the written CA file, transition to Running, the initial three-row snapshot, a post-create CDC change, and cleanup. The optional long-lived ClickPipe smoke fixture was unavailable and its separate step was skipped.

A successful no-upload path remains untested because mandatory CI has no PostgreSQL fixture with a publicly trusted certificate.

Stack

Position: 3 of 3. Based on #494 (issue-446-clickpipe-tls-guidance-v2); the parent remains unchanged.

Closes #447