docs(consul-postgres-ha): rewrite attestation-admission brief around identity-via-attestation

The previous brief framed attestation as a peer-admission filter
gated at mesh-conn (post-QUIC handshake stream tagged 0xAA, "does
your app_id match ours?"). Reframing per user feedback: attestation
is the source of *workload identity*, not a side-check at the
network layer. The service mesh (Consul Connect) is what actually
uses that identity for service-to-service auth.

Concrete shape that lands instead:

- Each workload's sidecar attests at startup. report_data binds the
  about-to-be-issued Connect leaf cert pubkey + a fresh broker
  nonce.
- A small admission broker runs alongside Consul on coordinators.
  It verifies the quote chain (via dcap-qvl or a sibling
  dstack-verifier), parses RTMR3's event log to extract the dstack
  app_id, checks against `admission-policy.hcl`, and on success
  issues a short-lived Consul ACL token bound to a SPIFFE-style
  identity. The Consul Connect CA stays stock; cert issuance just
  becomes ACL-gated.
- mesh-conn admission stays cheap (TURN_SHARED_SECRET env, same as
  today). It plumbs packets; trust lives one layer up. The user
  framed this as "the NAT-traversal layer is like joining a VPC."
- Cluster shared secrets (gossip key, Patroni passwords) move from
  Terraform `random_bytes` env into Consul KV under
  `cluster/<name>/secrets/*`, gated by the same attestation-issued
  tokens. The broker generates them on cluster genesis (Consul KV
  CAS race protection). The `cluster.tf` random_bytes resources
  for those three go away.

Locks in choices from the design discussion:
- Token broker between attestation verifier and Consul ACL (option
  δ from the discussion), not custom CA plugin (α), not SPIRE (β),
  not Vault (γ).
- Per-app-id policy via RTMR3 event log parse. Image-digest pinning
  is a phase 2 tightening, not a phase 1 requirement.
- `(*DstackClient).GetQuote(ctx, reportData []byte)` is the Go SDK
  entry point. Verified the API shape via deepwiki on the dstack
  repo.

Six open questions surface in the new brief — primarily:
- dcap-qvl Go binding vs sidecar dstack-verifier service for chain
  validation (Phase 0 picks).
- Policy file rendering (immutable in image vs Consul KV vs host
  file).
- Token TTL tradeoffs.

The new brief is ~300 lines, structured for an implementing agent
to pick up cold.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h4x3rotab