Retire satisfied onboarding secret placeholders

[cbusillo]

Summary

• align product onboarding placeholder suppression with live-target-runtime secret route matching
• when an existing configured context/global runtime secret binding satisfies an instance placeholder, retire the stale disabled placeholder instead of reimporting it
• prevent product onboarding reapply from leaving active duplicate runtime secret bindings that fail key-safety with ambiguous_binding

Motivation

After PR #1120 deployed and Odoo CM onboarding was reapplied, odoo-tenant-cm / cm / testing live-target-runtime dry-run failed closed with:

• run: 26846962611
• trace: launchplane_req_e659c2d33997484b85ef029951de6fe9
• code: runtime_key_safety_failed
• finding: ambiguous_binding

The likely cause is a configured context-level Odoo testing binding plus the newly imported instance-level disabled placeholder. Live-target-runtime treats context-level bindings as satisfying the instance route; onboarding previously skipped only exact context+instance matches.

Validation

• uv run --extra dev ruff check control_plane/workflows/product_onboarding.py tests/test_product_onboarding.py
• uv run --extra dev ruff format --check control_plane/workflows/product_onboarding.py tests/test_product_onboarding.py
• uv run --extra dev mypy control_plane tests
• uv run python -m unittest tests.test_product_onboarding