Correctness bugs found by audit

Verified defects in shipped code (file:line citations in the tracker).

• Every validation rejection is read as an approval. ValidationFunction does response.toUpperCase().contains("VALID") — and "INVALID" contains "VALID". The gate can never reject. Zero tests on the class.
• The "production default" Postgres store cannot write to Postgres. Both Postgres stores emit MERGE INTO ... KEY (col) VALUES (...), which is H2-proprietary; PostgreSQL 15 MERGE has no KEY clause. Invisible because every test runs H2.
• Three transient-field NPEs that only fire once a job is distributed (field initializers do not run on deserialization). One of them makes robots.txt silently fail open in any serialized crawler.
• Unguarded ServiceLoader iteration over the VectorStore SPI throws NoClassDefFoundError for any consumer on a default build. The correct guarded pattern already exists 50 lines up in the same file.
• Guardrail redaction never reaches the transcript. The raw reply is persisted before guardrails run, and only the returned object is redacted — so blocked content is replayed into the next prompt.
• docker-compose-session.yml pins a Flink 1.20.1 image while the project targets 2.2.1; since Flink is provided, jobs cannot run on it.

Roadmap epic. Detailed findings, file:line citations and sub-tasks live in the AI-grind tracker (project AGS), which is the source of truth for this work. Local dev — build, test, tracking, profiling — is managed with AI-grind.

Tracked as AGS-5 in the devtools-mcp tracker.

Start with the AGS-5 entry in the AI-grind tracker, which contains the file and line citations absent from this issue. Inspect the cited ValidationFunction, Postgres stores, ServiceLoader code, serialized job fields, guardrail persistence path, and docker-compose-session.yml, then use AI-grind for build and tests. Done means each listed defect is corrected and covered by appropriate verification across PostgreSQL, serialization, guardrails, and Flink execution.