M3-26: gate protected real-feature re-execution

[zhouning]

Goal

Bind the checked M3-25 real Chongqing predecessor to the existing production identity and object-store readiness gates, without promoting retained local material or manufacturing production evidence.

Acceptance criteria

• Verify the exact M3-25 evidence file/evidence SHA and bind its ResourceVersion, content, Iceberg/Parquet quality and GDA Control facts.
• Re-evaluate the current production identity and object-store profiles through their existing fail-closed validators.
• Require both fresh protected attestations to pass and bind the same source revision.
• Require tenant controls from both gates before protected re-execution can become eligible.
• Permanently reject direct promotion of retained local material; require fresh protected ingestion of the same content-bound source.
• Keep scheduler submission, provider mutation, production ingestion and production_ready unauthorized or false.
• Commit a self-validating pending decision that exposes every current external blocker.
• Add ADR-072, roadmap/system-of-record updates, CI validation and focused tamper/overclaim tests.

Current expected state

The checked profiles are structurally valid but pending. The committed decision must remain blocked_pending_protected_attestation with 85 explicit blockers and ready_for_protected_reexecution=false until external owners approve the profiles and produce both protected attestations.