feat: add read-only Trino rollout readiness

[benben]

Summary

• Add an optional capability-authenticated, read-only endpoint for registered Trino backend readiness.
• Observe every selected pod, including terminating pods, and correlate authenticated node membership with the exact target pod IPs and roles.
• Check stable coordinator identity and a dedicated canary's catalog metadata using explicitly mounted private credentials.
• Keep logical cell IDs separate from routing groups. Fail closed on incomplete configuration, unknown slots, stale/incomplete observations, and invalid responses.
• Extend the existing isolated multicell E2E with warm-blue, stopped-green, and warm-green readiness checks.

Scope and rollout

Disabled by default. Both documented secret-file variables are required to enable the endpoint. No database migration, tenant reassignment, catalog mutation, replica change, or Gateway route change is included.

This is one prerequisite for rollout orchestration, not permission to cut over: representative canary readiness does not prove every admitted tenant is prepared. Authoritative ongoing backend provisioning and a new-admission fence remain separate work.

The small routing-group carry-through overlaps the same change in #1183; neither PR changes existing ownership.

Validation

• Red-to-green regressions for missing metadata, wrong response paths, other-slot coordinator selection, and fixture pod identification.
• Full Kubernetes control-plane tests.
• PostgreSQL-backed Trino admin and canary eligibility tests.
• Real TLS HTTP tests covering credential scope, redirects, continuations, budgets, and errors.
• Isolated fixture rendering and harness tests.
• just lint.

The new real multicell E2E assertions must pass in CI before this draft is considered ready. Local HTTP fixtures are not evidence of a deployed private canary.

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	4	3	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +12 / -0
• Assertions: +52 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.

[bill-ph]

Reviewed the optional read-only Trino rollout-readiness endpoint, capability authentication, pod/node membership checks, coordinator/canary probes, fail-closed behavior, and the added multicell E2E coverage. I found no P0 blockers requiring code changes. The endpoint is disabled by default, does not mutate rollout state, and the remaining pending Analyze/build/unit checks are CI status rather than a code finding; the PR documentation also correctly states that local fixtures are not proof of deployed canary readiness.

Robo Bill