feat(platform): rehearse bounded provider identity on mainline

[zhouning]

Summary

• Replay historical M3-5 provider identity slice onto canonical main 0a1d606.
• Add bounded local OpenMetadata identity rehearsal: dedicated table/Create grant, policy-create denial, JWT rotation/revocation, cleanup, and immutable evidence validation.
• Keep Gravitino authentication, protected workload identity, OIDC, provider-wide minimum privilege, production identity, and production_ready explicitly false.
• Synchronize CI and staging candidate test lists; update roadmap, system-of-record, ADR-051, runtime inventory, and evidence.

Evidence

• Evidence SHA: 61b6a3429ae948f563bfc2bd012d8b586be581704cec646fd5e74b991243f03f
• local_openmetadata_bounded_identity_verified=true
• local_openmetadata_minimum_privilege_verified=true (scoped above provider-mandatory DefaultBotRole)
• provider_minimum_privilege_verified=false
• oidc_verified=false
• production_identity_verified=false
• production_ready=false

Verification

• Provider identity validate/verify: passed
• Focused and metadata regression tests: passed
• CI-equivalent required platform tests: 649 passed
• No staging or production workflow triggered