Shorten Postgres rename help to the hostname change and connection-string update

[sdairs]

Shorten Postgres rename help to the hostname change and connection-string update

cloud postgres update --help currently says --new-name changes the hostname and certificates, then asserts that "pinned CAs break" and directs users to fetch certificates again. Keep the useful hostname warning, but remove the unsupported CA-invalidation claim.

Proposed help

Under the existing CONTEXT FOR AGENTS: block:

  --new-name changes the service hostname; re-read `cloud postgres get` and update connection strings.

This is a non-obvious consequence of renaming and gives the next action needed to reconnect. It belongs on the update command. No certificate-management explanation is needed in this short help block.

Historical basis

• Rename support shipped in Add --name to cloud postgres update for parity with service update #668, fixing cloud postgres update cannot rename a service: no --name flag, though the API PATCH accepts name #663.
• The warning was added during the documentation audit in Audit AGENTS.md, README and every help screen for 0.4.2 #688, closing 0.4.2 documentation audit: AGENTS.md, README, and every help screen #678, specifically in commit 52594745.
• The API specification at that commit warns that changing the name updates the hostname and certificates. It does not say that the CA changes or that existing CA trust breaks.
• Standardize scoped Cloud resource selectors #910 later changed the flag spelling to --new-name; it retained the CA assertion.

Live evidence

On main df81e46cfec0bb58ea981d17cc6fd2de24442e7d (0.5.0), the September 23 disposable-service QA run saved the CA, renamed the service, and connected to its new hostname using the original CA. The first attempt failed hostname verification; a retry ten seconds later succeeded with verified TLS and the expected data. The CA bundles fetched before and after rename had identical SHA256 hashes.

This disproves the unconditional "pinned CAs break" claim. It does not establish that CAs can never change or guarantee a propagation interval. The proposed help makes neither claim.

Acceptance

• Replace the existing two-line rename/certificate warning in crates/clickhousectl/src/cloud/postgres.rs with the short hostname/action guidance above.
• Remove the unconditional CA-breakage claim and the associated instruction to fetch certificates again.
• Keep this a help-only correction. Check the rendered help and existing structural help checks; do not add tests that pin the sentence verbatim.

Searched existing open and closed issues for Postgres rename and pinned-CA guidance; the earlier rename-capability issues do not cover this wording correction.