feat: add public lightweight dataops run

[zhouning]

Summary

• execute public Landing GeoJSON/ZIP through a synchronous lightweight DataOps profile into content-addressed EPSG:4326 GeoJSON and independent quality evidence
• add a least-privilege PostgreSQL synchronous success finalizer while preserving the checksum-frozen DolphinScheduler verdict
• record real Natural Earth Run/Artifact/Quality/Lineage/replay evidence and update the AR-2 roadmap

Verification

• 13 focused unit tests passed
• 7 new PostgreSQL integration tests passed
• existing + new PostgreSQL gateway suites: 9 passed
• Natural Earth smoke: 177 features, succeeded state version 3, replay created no output/quality files or ledger duplicates
• Ruff, gateway static validation, workflow YAML parsing, JSON parsing, and git diff checks passed

Boundaries

• production_ready=false
• does not claim DolphinScheduler execution, active STAC/PostGIS service, or rollback
• does not change Chongqing protected admission