Apply remediation safely

pgdba check prints remediation SQL for every finding; --apply executes the actions you approved instead of only printing them.

pgdba check --apply                          # per-action prompts
pgdba check --apply --yes                    # blanket approval — requires --apply
pgdba check --apply --only connection.max_connections

The gates, in order

1. Findings are ranked by severity; you select which to apply (or approve all with --yes).
2. A blast-radius warning shows the action count plus every HIGH-risk action’s remediation line before anything runs.
3. Per-action confirm unless --yes. On a non-TTY run, --apply without --yes is refused — the report is still written (the refusal is recorded in the audit log), and the exit is 1.
4. Every action is audited: the report’s audit log records applied, skipped, failed, and retrying rows with attempts, in execution order.

Hard limits

• RDS/replica targets refuse writes per finding (reported in the audit log).
• Multi-statement remediation stays dry-run for manual review.
• Deadlocked or serialization-failed statements retry up to 2 times.
• Nothing writes without --apply; cron must never pass it.