On Postgres the daemon anchors the audit chain but every reader reports the anchor unsupported and exits 2 #558

With a Postgres audit store and SYSKNIFE_CHECKPOINT_DB set, the daemon anchors the chain every 15 minutes, and every reader reports the anchor as unsupported and exits 2. Tail truncation on Postgres is never detected.

What happens

• start_checkpoint_anchoring hands state.audit (an Arc<dyn AuditStore>, which can be the Postgres store) to spawn_periodic_anchor, which reads fetch_chain_rows() through the trait. Postgres chains are anchored.
• verify_configured_anchor (apps/sysknife-cli/src/runner.rs:1483-1506) short-circuits every Postgres config with CannotVerify { reason: "checkpoint anchoring is implemented for the sqlite backend only ..." }. The daemon's own behaviour contradicts that reason.
• sysknife audit checkpoint ignores [storage] and opens a SQLite store only. Since fix(audit): resolve checkpoint and MCP stores consistently #636 it picks the file with sysknife_core::resolve_audit_store() (runner.rs:1371-1402), which chooses between SQLite paths and never reads the backend.

A correctly configured Postgres deployment therefore gets a permanent exit 2, which teaches the operator to ignore 2.

Docs, same area

• SECURITY.md:563-584 tells operators to set SYSKNIFE_CHECKPOINT_DB with systemctl edit sysknife-daemon. verify_configured_anchor reads it from the calling shell (runner.rs:1491), and sudo sysknife audit verify, the form the docs recommend for system stores, resets the environment. That run prints the "no anchor configured" caveat while the daemon is anchoring.
• docs/configuration.md:115 describes the variable as used by audit checkpoint only.
• docs/the-audit-chain.md:499 says "Three checks run". The code runs a fourth check, the status cross-check, which can exit 1. (The "out of scope by design" line this item also quoted is gone: fix(audit): chain SQLite status transitions and expose verdicts #571 rewrote that part of the page to describe status_check, at 309-335.)

Fix

1. In verify_configured_anchor, read rows through the Postgres store when the backend is Postgres and call verify_against_anchor. Make run_audit_checkpoint honour [storage] too.
2. Fix the three docs points. For the environment one, either document sudo -E / setting it in the verifying shell, or read the anchor URL from config.toml so daemon and CLI share one source. I lean to config.toml.

Done when

A Postgres contract test (the suite already runs in CI) anchors, truncates the tail, and expects Truncated from audit verify.

Nearest existing: #221 (closed), an inconclusive anchor masking a broken chain.

Getting started

CONTRIBUTING.md has the build and test commands. No CLA and no copyright waiver. The project is MIT; sign off each commit with git commit -s (the required dco check enforces it since #732).