Add `postconditions` to `GTW.RST.Resource`

The postconditions are checked before `scope.commit`, if any, and can
check things like resource-specific permissions for object references.