[FEATURE] Refuse Postgres storage size or class changes the cluster cannot apply #3691

The bundled Postgres StatefulSet's volume size and StorageClass are immutable once it exists. A changed value fails partway through an apply. Detect it first.

Tracks "Refuse storage changes the cluster cannot apply" in the Operator Supplied Values workstream of the Extensible Install Roadmap.

Current state (0b635b80): the storage class is set at render (cmd/ate-setup/internal/steps/postgres.go). Nothing compares it with the live object.

Required changes: before applying, compare the rendered volume claim template size and StorageClass with the live StatefulSet. Stop with an explanation of the options if they differ.

Dependencies: none. Foundation phase.

Enforcement: a unit test with a fake live StatefulSet, plus a kind test that changes the size and asserts a clean refusal before any apply.

Parent Issue: #3165