fix: align AppArmor profile with salt managed version

Sync sbpostgres_apparmor with the salt repo (PR #526, merged):
- Add WAL dir rwkl entries to parent and both sub-profiles
- Consolidate systemd notify to single /{,var/}run/systemd/notify rule
- Add /usr/bin/kill and signal hup rule to parent
- Add pg_archivecleanup ix to postgres_shell

Author: Crispy1975

ansible/files/postgresql_config/sbpostgres_apparmor

@@ -24,14 +24,13 @@ profile sbpostgres flags=(attach_disconnected) {
     # lock permission for pgroonga
     /data/pgdata/pgroonga.log k,
 
+    # WAL directory - needs link permission for segment recycling
+    /data/pgdata/pg_wal/** rwkl,
+    /data/pgdata/pg_wal/  rw,
+
     # Systemd notification socket (for Type=notify services)
-    /run/systemd/notify w,
     /{,var/}run/systemd/notify w,
 
-    # Allow disconnected paths (for mount namespaces)
-    @{run}/systemd/notify w,
-    /run/systemd/notify w,
-
     # Full network access
     network inet stream,
     network inet6 stream,
@@ -50,6 +49,8 @@ profile sbpostgres flags=(attach_disconnected) {
     /usr/bin/false ix,
     # kill needed for postgresql to reload itself
     /bin/kill ix,
+    /usr/bin/kill ix,
+    signal (send) set=(hup) peer=unconfined,
 
     # When parent executes shell, transition to restricted profile
     # This accounts for popen, which postgres uses for any child process
@@ -79,7 +80,7 @@ profile sbpostgres flags=(attach_disconnected) {
     /opt/supabase-admin-agent/supabase-admin-agent-linux-arm64 Pix -> postgres_shell,
     /opt/supabase-admin-agent/supabase-admin-agent-linux-amd64 Pix -> postgres_shell,
 
-    profile postgres_shell {
+  profile postgres_shell {
         #include <abstractions/base>
 
         /usr/bin/* m,
@@ -108,13 +109,16 @@ profile sbpostgres flags=(attach_disconnected) {
         /nix/store/*/bin/wal-g-2 ix,
         /nix/store/*/bin/pgbackrest ix,
         /nix/store/*/bin/pg_dump ix,
+        /nix/store/*/bin/pg_archivecleanup ix,
 
         # file path permissions
         /** r,
         /data/wal_fetch_dir/ rw,
         /tmp/wal_fetch_dir/ rw,
         /var/lib/postgresql/data rw,
         /data/pgdata rw,
+        /data/pgdata/pg_wal/** rwkl,
+        /data/pgdata/pg_wal/  rw,
         /data/latest-lsn-checkpoint-v2 rw,
         /data/previous-lsn-checkpoint-v2 rw,
         /var/lib/postgresql/data/recovery.signal rw,
@@ -149,7 +153,7 @@ profile sbpostgres flags=(attach_disconnected) {
 
     }
 
-    profile pgbackrest_shell {
+  profile pgbackrest_shell {
         #include <abstractions/base>
 
         /usr/bin/* m,
@@ -176,6 +180,8 @@ profile sbpostgres flags=(attach_disconnected) {
         /tmp/wal_fetch_dir/ rw,
         /var/lib/postgresql/data rw,
         /data/pgdata rw,
+        /data/pgdata/pg_wal/** rwkl,
+        /data/pgdata/pg_wal/  rw,
         /data/latest-lsn-checkpoint-v2 rw,
         /data/previous-lsn-checkpoint-v2 rw,
         /var/lib/postgresql/data/recovery.signal rw,