Postgres Ha on OCI: Why Your Failover Passes Every Test but Breaks in Production