postgres: the tenant-visible Secret surface has no guard while postgres-rd selects the trust anchor by label #3701

packages/system/postgres-rd/cozyrds/postgres.yaml:46 includes matchLabels: internal.cozystack.io/tenant-ca: "true" under spec.secrets.include, so a Secret carrying that label joins the tenant's readable set as soon as the lineage webhook can resolve its owner. Nothing in packages/apps/postgres/ pins what that surface may contain: there is no dashboard-resourcemap_test.yaml, and the dashboard Role granting <release>-credentials is asserted nowhere.

Two changes break it without turning a test red. A rule granting secrets with no resourceNames is unrestricted rather than narrow, so it adds no name for a name-by-name check to notice. And a second matchLabels entry on a label the operator stamps on its own Secrets reaches key-bearing ones while every name in the file stays correct.

qdrant pins both layers in cozystack/cozystack#3341, and both pins were confirmed by mutation rather than by reading: the ResourceDefinition against the rendered chart, because the template globs cozyrds/ and reading one file there misses a second, and the Role with its binding compared whole across value permutations instead of probed for known-bad names. The two files port to postgres almost verbatim; only the chart path and the expected Secret set differ. nats has the same gap.

This predates the qdrant work: the selector is on main, and the missing tests are missing there too.