fix: add durable cloud api runtime adapter

docs/cloud-api-runtime.md

@@ -1,7 +1,9 @@
 # Cloud API Runtime
 
 The L1 `hwlab-cloud-api` runtime is a minimal local HTTP/JSON-RPC service. It
-does not deploy to DEV or PROD and does not claim live database persistence.
+does not deploy to DEV or PROD from source tests and does not claim live
+database persistence unless both DB readiness and the durable runtime adapter
+readiness are live.
 
 ## Local Smoke
 
@@ -16,6 +18,9 @@ and verifies:
 
 - `GET /health` reports `status: "degraded"` when live DB persistence is not
   connected.
+- `GET /health` reports DB readiness and runtime durable adapter readiness as
+  separate components. A memory adapter remains non-durable even when DB env
+  fields are present.
 - The DB contract reports required env names, redacted Secret refs, env
   injection, connection attempt status, connection result, `liveConnected`,
   `liveDbEvidence`, DNS/TCP/auth/schema readiness layers, and redaction/safety
@@ -29,14 +34,29 @@ and verifies:
 
 ## Persistence Boundary
 
-The current runtime store is process-local memory:
+The default local runtime store is process-local memory:
 
 - `runtime.adapter: "memory"`
 - `runtime.durable: false`
 - `runtime.status: "degraded"`
 
-This is intentional for L1. If `HWLAB_CLOUD_DB_URL` and
-`HWLAB_CLOUD_DB_SSL_MODE` are absent, health reports `db.status: "blocked"`.
+This remains the safe local default. DEV can opt into the durable adapter with
+non-secret env flags:
+
+- `HWLAB_CLOUD_RUNTIME_ADAPTER=postgres`
+- `HWLAB_CLOUD_RUNTIME_DURABLE=true`
+
+The Postgres adapter uses `HWLAB_CLOUD_DB_URL` from
+`hwlab-cloud-api-dev-db/database-url`; source records only the Secret reference
+and non-secret DNS contract. The adapter reports `runtime.ready: true` only
+after a live schema query proves the required runtime tables and columns exist.
+If DB auth or schema is missing, `/health/live` stays degraded and reports a
+runtime blocker such as `runtime_durable_adapter_auth_blocked` or
+`runtime_durable_adapter_schema_blocked`. Fixture data and env presence are
+never promoted to `runtime.liveRuntimeEvidence`.
+
+If `HWLAB_CLOUD_DB_URL` and `HWLAB_CLOUD_DB_SSL_MODE` are absent, health
+reports `db.status: "blocked"`.
 If both env vars are present, cloud-api attempts a short read-only TCP
 connection to the DB endpoint from the injected runtime env. The health payload
 keeps all endpoint details redacted and reports only: