Decide the usage tenant Postgres image — ADR-0028 D1 reversed this repo and nobody was told

### Context

`lightbridge-authz` ADR-0028 (2026-08-31) **re-decided in favour of TimescaleDB** for the usage tenant, 16 days after this repo decided against it — and this repo has not been told.

**What this repo decided (2026-08-15, `f6eeb25f5`)** — `charts/lightbridge-db/values.yaml:8-14`:

> `lightbridge-authz-usage` does not need TimescaleDB: its bucketed aggregation uses stock PostgreSQL 14+ `date_bin` … so it degrades to a plain heap table on this cluster's stock CNPG image.

PR #1007 (*restore the `lightbridge-usage-db` CNPG cluster*) was closed unmerged and replaced by #1009, which recorded real physical blockers: CNPG's `postgresUID` immutability (26 vs Timescale's 70/1000) and a glibc→musl base change under five live tenants, one of them the platform auth DB.

**What `lightbridge-authz` decided afterwards** — `docs/adr/0028-finops-first-settles-the-usage-store-conventions.md:85-90`:

> **This ruling does not authorise the stock-PostgreSQL fallback.** If no CNPG-compatible image satisfies both constraints, that comes back to the owner as a decision, not down to an implementer as a fallback. The fallback costs compression, continuous aggregates and retention policies at once — and D6's 13-month raw window is sized *assuming* compression from day 7 … the retention floor is a correctness property, not a knob.

**Live state on `hetzner-prod` today** — the ADR's requirement is unmet:

```
$ kubectl --context=hetzner-prod get clusters.postgresql.cnpg.io -A
converse lightbridge-main-db 88d 2 2 Cluster in healthy state
(no lightbridge-usage-db)

$ kubectl --context=hetzner-prod -n converse exec lightbridge-main-db-1 -c postgres -- \
psql -U postgres -d usage -At -c "SELECT 'installed:'||coalesce((SELECT extversion FROM pg_extension WHERE extname='timescaledb'),''), 'available:'||(SELECT count(*) FROM pg_available_extensions WHERE name='timescaledb');"
installed:|available:0
```

### Why this is filed

ADR-0028 D1 delegates image selection to *"the Phase 1 infra PR in `ai-helm`/`ai-helm-values`"*. **That PR has no ticket here.** `gh search issues --repo ADORSYS-GIS/ai-helm timescale` returns exactly one result — #1080, a dashboards story. So the work that gates four `lightbridge-authz` stories is untracked in the repo that must deliver it.

Blocked on this: `lightbridge-authz` **#582**, **#583**, **#587**, and roughly half of **#549** (a 2138 MB `usage_events` table on the cluster that had the 2026-08-29 outage).

D1 says an impossible image "comes back to the owner as a decision". **Nobody has come back.** This ticket is that escalation.

### Acceptance Criteria

1. A decision is recorded — in this repo, referenced from ADR-0028 — that is one of: (a) a named CNPG-compatible Timescale image for the usage tenant, (b) a dedicated `lightbridge-usage-db` cluster, or (c) an **explicit, owner-signed** ruling that the stock-PostgreSQL fallback is accepted, with the compression/retention consequences from D6 costed.
2. If (a) or (b): whether the image is plain `timescaledb` or `timescaledb-ha` is recorded, **including whether `timescaledb_toolkit` is present** — `lightbridge-authz`#587 AC5 needs it for exact percentile aggregates, and the plain image does not carry it.
3. If (c): `lightbridge-authz` #582, #583, #587 are re-scoped against stock PostgreSQL, and D6's 13-month raw window is re-sized without compression.
4. The stale comment at `charts/lightbridge-db/values.yaml:8-14` is corrected either way — it currently asserts a decision that ADR-0028 superseded.
5. #1009's two physical blockers (`postgresUID` immutability, glibc→musl under five live tenants) are each either resolved or recorded as the reason for (c).

### Out of Scope

The migration of existing rows (`lightbridge-authz`#588) and the dashboards built on top (#1080). This ticket ends when the image question has an owner-signed answer.

### Human accountable owner

@stephane-segning

### AI Usage Declaration

- [x] AI-assisted — investigated and drafted by Claude Code (Opus 5). Every quotation above was re-verified against `ai-helm@main`, `lightbridge-authz@main` and the live `hetzner-prod` cluster by the maintainer before filing. The read-only `psql` output is reproducible with the command shown.
- [x] The human owner is accountable for the decision this ticket asks for; the ticket does not propose an answer.