feat: add protected Chongqing admission readiness gate

[zhouning]

Summary

• add M3-31 readiness contract binding M3-28/M3-29/M3-30 evidence
• freeze six derivation, eight governance, and one protected attestation requirement as fail-closed pending inputs
• add CI/staging parity validation, ADR-078, roadmap and system-of-record updates

Safety boundary

• no source payloads or absolute paths are added
• admission_eligible, Landing, ResourceVersion, PlatformRun, scheduler/provider mutation, production ingestion and production readiness remain false

Verification

• 720 required platform tests passed locally
• focused M3-28/M3-29/M3-30/M3-31 tests passed
• Ruff and git diff --check passed