Make PostgreSQL ClickPipe TLS failures actionable

[sdairs]

Summary

• document secure PostgreSQL ClickPipe TLS defaults, conditional PEM CA use, hostname overrides, and source prerequisites in clap help and README examples
• preserve API errors while adding narrow x509 hints for unknown authorities and hostname mismatches
• pin rendered help, documentation, diagnostic matching, and subprocess error output

Tests

• cargo test -p clickhousectl postgres_
• cargo fmt --all --check
• cargo clippy -p clickhousectl --all-targets -- -D warnings
• env DO_NOT_TRACK=1 target/debug/clickhousectl cloud clickpipe create postgres --help

Closes #446

[sdairs]

Carry-over review from PR #494 (old PR for #446). This PR is the better implementation (pure postgres_tls_error_hint() function, after_help visible in short help, README pinned by an include_str! test, negative cases pinned). One required fix that carries over directly from #494's one review thread:

1. Restore --publication-name to the publicly trusted README example. On Make PostgreSQL ClickPipe TLS failures actionable #494, macroscope flagged (High) that the PostgreSQL examples omitted --publication-name, pushing users into the API's publication auto-create path which fails with only the documented privileges; sdairs accepted and confirmed the fix: "Fixed in e6befe5… Both PostgreSQL ClickPipe examples now pass --publication-name clickpipes, matching the publication named in the prerequisites." In this PR, the private-CA example includes it, but the publicly trusted example (README.md:~778-784 on the head branch) does not — while the new prerequisites still instruct the user to create a publication covering every mapped table. Add --publication-name to the first example (or document the auto-create privilege requirement) and extend the README pin test to assert it.

2. Minor: subprocess coverage regressed slightly vs Make PostgreSQL ClickPipe TLS failures actionable #494 — only the unknown-authority path is exercised end-to-end; hostname-mismatch and no-hint cases are unit-only. Consider adding a subprocess case for hostname mismatch. Also note the IP-SAN match is now case-sensitive ("IP SANs") — correct against Go's current x509 string, but slightly less robust to upstream rewording.