feat: expose scoped Trino routing snapshots

[benben]

Summary

• Add a machine-only routing snapshot containing eligible Trino principals and their configured routing groups, without credentials or backend endpoints.
• Preserve legacy ownership and explicit registered routing groups. Exclude disabled, unready, unassigned, and unconfigured warehouses; fail the whole export on query errors, duplicate principals, or size overflow.
• Extend the existing read-only token surface deliberately with one GET, with auth and permission-boundary regression tests.
• Add PostgreSQL eligibility coverage and real-stack fixture assertions. Document refresh, bounds, and recovery.

Validation

• Focused routing, registry, and auth regression tests.
• PostgreSQL-backed Trino admin and config-store tests.
• Kubernetes control-plane suite and isolated fixture suite.
• Standard lint and diff checks.

Rollout

This provides the control-plane contract only. Gateway polling, deployed configuration, and authenticated no-header end-to-end validation are separate gates. Existing warehouse ownership is unchanged. Keep this draft until the new real-stack assertions have passed.

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	2	3	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +3 / -0
• Assertions: +28 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.

[bill-ph]

Reviewed the routing snapshot implementation and tests. I found no P0 blockers requiring code changes. The endpoint is scoped to machine-token auth, bounded, atomic on errors/duplicates/size overflow, and the CI checks are passing.

Robo Bill

[benben]

Superseded by the shared compute pool publication and tenant-admission approach in #1205. Closing the separate routing-snapshot implementation; existing provisioning remains unchanged.