R-469: lift the MariaDB half of the engine-major rule; add R-450's own-edge clause

Slice 4 shipped 2026-09-13, so the rule's own expiry condition is met — for MariaDB.
PostgreSQL and MySQL stay refused (R-463: no pg_upgrade, refuses to start on an
older major's datadir across eleven templates).

A MariaDB major is now allowed ONLY as its own edge: never in the same commit as
another image move in that template (R-450, the bookstack 0b73e5e shape).

Two new decoy cases; two red-proofs, each seen to fail. 40 cases green.
No template moved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,34 @@
+## RULE LIFT: a MariaDB major may cross, as its OWN EDGE; PostgreSQL may not (2026-09-21, R-469 + R-450)
+
+The engine-major rule of 2026-09-13 named its own expiry — *until the Update button takes a verified
+backup as its precondition* — precisely so it would be removed deliberately rather than forgotten.
+**That condition was met on 2026-09-13**, the same day: update arc Slice 4 shipped (controller
+v0.237.0/v0.238.0, any backup tier since v0.239.0). This is the deliberate removal, and it removes
+exactly half.
+
+- **LIFTED — the four MariaDB services** (`bookstack-db`, `kimai-db`, `nextcloud-db`, `romm-db`).
+  They now have both halves: a verified backup in front of the Update, and `MARIADB_AUTO_UPGRADE=1`
+  on every sidecar (R-459), whose conversion the harness WATCHED run on the E3/E3b edges with the
+  seeded data read back after.
+- **NOT LIFTED — the eleven PostgreSQL services, and MySQL.** Postgres performs no `pg_upgrade` and
+  REFUSES to start on an older major's datadir (R-463). A backup is a route BACK, not a conversion —
+  the app simply would not come up. MySQL has nothing measured at all. Both stay refused until R-463
+  has a scripted `pg_upgrade` edge proven on all eleven. The refusal now says this instead of citing
+  the shipped R-448.
+- **NEW CLAUSE — one edge, one migration (R-450, recorded 2026-09-02 and now enforced).** A MariaDB
+  major must be the ONLY image move in its template in that commit. bookstack's `0b73e5e` moved the
+  application 25.02.2 → 26.05.2 **and** MariaDB 11.6 → 12.3 in one commit: two migrations behind one
+  edge, and an unreadable failure when it breaks. **Within a major is unaffected** and may still ride
+  with anything.
+- **The gate says what it ALLOWED**, by name, rather than passing in silence — a lifted rule that
+  goes quiet is a lifted rule nobody can audit.
+- **Decoys (R-421): two new cases, and two red-proofs each seen to fail.** Removing the own-edge
+  check lets the bundled kimai case pass; emptying `LIFTED` turns the lone MariaDB major back into a
+  refusal. The old "a lone MariaDB major is REFUSED" case is now the "…is ALLOWED" case, which is the
+  lift itself. 40 cases, all green.
+
+`scripts/check-engine-major.py`, `CLAUDE.md`, `scripts/test_gate_decoys.py`. No template moved.
+
 ## GATE FIX: the copy gate could not run in CI at all (2026-09-20, R-595)
 
 **Six pushes in a row turned CI red while the local pre-push hook was green**, and each sent an alarm