docs(architecture): ADR-007 — two kv engines (sqlite + postgres) behind one trait

Dissolve OQ-10's circular "standing offer" framing and record the
engine decision the POC evidence already supported:

- ADR-007 (new): kv tier ships sqlite (default) + postgres (feature
  `postgres`, default-off), constructor-selected per node; records the
  deployment economics (classical kv+fs+relational downstream stack
  collapses to one relational engine + fs), the pg impl contract
  (POC #5 B5 posture deltas), the CI sweep-safety gate under
  --all-features, redb ruled out (POC #6), and posture defaults as
  deferred cost in the ADR-006 pattern
- ADR-003: amended status (engine pin widened by ADR-007); kv entry
  notes the widened engine set
- ADR-004: reconciliation note — the "two backends" count is tiers,
  not engines
- backends-and-dispatch.md: tier≠engine distinction, pg engine
  section, co-tenancy note (same-file consumer writes share sqlite's
  single-writer ceiling), substitution-door precedent
- open-questions.md: OQ-10 resolved-by-ADR-007, with the
  why-this-is-not-Schrödinger's-code record (a deployment running
  alkblobs cannot pre-exist the pg engine — OQ-09 precedent); parked
  index narrowed to OQ-07/OQ-08
- overview.md: layer map + dependency posture reflect the `postgres`
  feature; README.md: ADR-007 in tables + corollary applications
- phase-0.md / pg+redb findings: promotion + supersession notes

Trigger framing survives only as deployment guidance (which engine a
node chooses — topology, not throughput), not as a gate on the crate's
own work.

Verified: cargo test, clippy --all-targets -D warnings, fmt --check.
Docs-only change (Phase 1 architecture); no implementation yet.

docs/architecture/README.md

@@ -27,6 +27,15 @@ there — not inherited as hedges:
   two backends (kv small / fs large — both required by measured scale
   economics); the path→hash mapping layer (the alkfs/alknet "vfs" shape)
   is a consumer-layer concern and must never become a third backend.
+- **ADR-007** widens the kv tier's engine set rather than hedging it:
+  sqlite (default) + postgres (feature-gated) behind one trait. The
+  deployment economics this records: a downstream node (git server, vfs)
+  classically needed three storage systems — kv + fs + relational — and
+  this design collapses them to **one relational engine + fs**, with the
+  engine a per-node constructor choice. Resolved from evidence in hand
+  (POCs #3/#5/#6); the would-be "deployment trigger" framing was caught
+  at review as circular hedging (a deployment running alkblobs cannot
+  pre-exist the engine) and closed on the OQ-09 precedent.
 
 ## Architecture Documents
 
@@ -50,6 +59,7 @@ there — not inherited as hedges:
 | [004](decisions/004-two-backends-no-third.md) | Exactly two backends; manifest layers stay above | Accepted |
 | [005](decisions/005-pooled-cas-and-gc-mechanism.md) | Pooled CAS, liveness seams, mark-and-sweep, delete windows | Accepted |
 | [006](decisions/006-verification-posture-and-transfer-encoding.md) | Whole-blob verification; transfer encoding excluded by scoping | Accepted |
+| [007](decisions/007-two-kv-engines-sqlite-and-postgres.md) | Two kv engines (sqlite + postgres) behind one trait; constructor-selected | Accepted |
 
 ## Open Questions
 
@@ -57,7 +67,8 @@ Tracked in [open-questions.md](open-questions.md). The Phase 0 register
 (OQ-BL-01..06) is promoted there with its resolutions; two questions
 remain parked — OQ-07/OQ-08 externally-owned (alkgit seam mapping,
 alkfs intake; carried for visibility, gating nothing here). OQ-09
-(namespace-visibility default) resolved closed-by-default. **Deferral
+(namespace-visibility default) resolved closed-by-default; OQ-10
+(second kv engine) resolved by ADR-007. **Deferral
 policy (the "Schrödinger's code" rule):** a *decision this crate needs
 before shipping* may not be deferred on a dependency that is itself
 waiting for this crate to exist. Two parking kinds remain legitimate:
@@ -68,7 +79,8 @@ crate) that gate no decision here — full definitions in the header of
 because it recurs: a fact this crate must create (its own first
 deployment, its own first consumer) is never a deciding input —
 decisions stand on evidence in hand, and future needs reopen via named
-requirements, not via waiting.
+requirements, not via waiting. (Corollary applications so far: OQ-09
+and OQ-10 both resolved on it.)
 
 ## Lifecycle