M3-20: bind real Active Metadata projection to durable Gravitino runtime

[zhouning]

Problem

M3-19 persists the real Chongqing provider binding, but its Gravitino target is a local memory catalog. The binding ref has no provider runtime identity, so it cannot distinguish that ephemeral target from a restart-continuous durable provider.

Goal

Create a runtime-bound durable promotion candidate for the same immutable Chongqing ResourceVersion. Materialize its Gravitino projection in an isolated JDBC-backed catalog, require exact no-op replay before and after ordered PostgreSQL/Gravitino restart, and keep the existing M3-19 ledger untouched.

Scope

• Validate committed M3-19 evidence before provider mutation.
• Reuse the path-free Chongqing inventory and content SHA; do not commit source data or absolute paths.
• Add an independent durable projection plan and authorization contract.
• Bind the logical provider ref to namespace, service, StatefulSet and PVC identities.
• Create through a schema-bounded Basic principal; deny catalog administration.
• Require immediate replay and first post-restart replay to be no_op with zero mutations.
• Verify PostgreSQL and Gravitino pods rotate while service, StatefulSet and PVC identities remain stable.
• Emit sanitized evidence, ADR, Platform Truth/System-of-Record updates and required CI validation.

Non-Goals

• Changing the M3-19 binding schema or ledger row.
• Production deployment, OIDC/TLS, protected workload identity, production object storage or production ingestion.
• Claiming terminal PlatformRun success or production-ready durability.

Acceptance Criteria

• The same ResourceVersion UUID and Chongqing content SHA are observed in retained OpenMetadata and the durable Gravitino table.
• First apply is exactly one bounded table mutation; immediate replay is no_op/0.
• Ordered PostgreSQL then Gravitino restart changes pod UIDs but preserves runtime/PVC identities.
• The first post-restart apply is no_op/0 without repair, with identical table projection and logical binding.
• A runtime-bound promotion SHA distinguishes the durable provider from the M3-19 memory provider.
• M3-19 binding persistence remains unchanged and the new candidate is not committed to the ledger.
• Local evidence is sanitized and all production claims remain false.

Status

in_review

Pull Request

#36

Execution Gate

allowed