Add a transactional R and Shiny poll workbench

[sdairs]

A trusted loopback Shiny workbench creates fictional polls, records synthetic responses, displays grouped counts, refreshes another browser's changes and closes the poll. Participant codes are deduplication keys, with matching replay retained after closure and mismatched choices rejected.

All multi-write operations use the connection passed to poolWithTransaction. A parent poll lock coordinates responses and closure; creation and response faults roll back earlier writes. Composite foreign keys and natural-key uniqueness back the workflow. Separate owner/runtime roles, explicit verified libpq TLS, a finite pool and a complete renv lock keep setup and runtime boundaries visible. Runtime credentials remain trusted; direct SQL can bypass parts of the application protocol.

Native acceptance on 2 October 2026: fresh ARM64 R4.6.1 build and isolated renv restore, source parsing, 5 domain checks, empty-schema setup plus repeated migration/seed, 7 real Cloud checks and 7 browser checks. Live coverage includes independent R process contention, actual blocked sessions, forced second-write rollback, grants, CA/hostname negative controls, foreign/missing WebSocket Origins with zero-write observations, maximum-label mobile layout, and confirmed original-process exit before restart with durable replay.

CI restores the lock and runs native local checks without Cloud credentials. Companion article and raw evidence remain local, outside this scoped PR. No public survey deployment, live-push, identity or statistical-inference claims.

Follow-up: qualify numeric identity ordering when projecting IDs as text. R setup inserted 12 polls with tied creation timestamps; actual list_polls through the runtime pool returned IDs 12 through 1. The old unqualified text alias control disagreed with numeric order. This is one targeted Cloud ordering case, not a repeat of the original seven Cloud/seven browser suites. Existing native local checks pass at the corrected head.