refactor(backup): bundle WAL-G with PostgreSQL image

[vishr]

Summary

• bundle checksum-verified WAL-G v3.0.8 into the multi-arch onebox-postgres:18 image
• remove operator download, host architecture detection, checksum verification, upload, and host-binary staging
• retain only a versioned generated credential adapter mount; the image owns WAL-G
• publish and verify the image on amd64 and arm64
• update the product boundary, backup guide, generated CLI reference, and architecture review

Image contract

onebox-postgres:18 remains the single curated PostgreSQL runtime. Its contents include PostgreSQL extensions and WAL-G; WAL-G is not a separate image variant or tag.

Live-test fixes

• create the host-side adapter directory before atomically staging its generated wrapper and trust store
• select the pulled image digest by repository identity across Docker's complete RepoDigests list instead of trusting list order

Verification

• just docs-generate-check
• just workflow-check
• go test ./... (2,030 passed)
• local Docker build, wal-g --version, and final-image check for WAL-G/CA roots with no Go runtime
• fresh Lima VM: full TestServerProbes passed in 434.7s against the exact locally built image served from a VM-local registry, including enablement, WAL archiving, base backup, generation recovery, repeat enablement, and teardown