Add Gateway-managed shared catalog cell reconciliation

[benben]

Summary

Opt-in shared catalog management for registered Trino blue/green cells. Legacy/static cells remain unchanged.

• Paused compatibility mode refreshes auth and OPA without catalog mutations or new Ready admissions.
• Gateway-managed mode writes only the active backend, using durable ownership and one-shot DDL intents.
• Freeze before standby startup; certify bulk catalog state, every previously admitted tenant credential, and the exact target process; release after cutover before draining.
• Dedicated capability-protected provisioning endpoints reuse existing read-only readiness and explicit canary configuration.

Stack / merge order

Readiness prerequisite #1184 is merged. This branch is rebased onto current main and contains only its seven intended dependency/runtime commits, without duplicating the merged readiness change. It still includes and depends on #1186 lifecycle/strict-transport commits. Merge #1186 first; this branch will then be rebased to remove that dependency from its diff. Endpoint and runtime changes are independently reviewed.

Validation

Red/green ownership and transport regressions; full Kubernetes control-plane suite; PostgreSQL admission-history tests; targeted 10,000 existing-catalog no-DDL test; repository lint. Actual isolated Gateway/Trino shared-mode end-to-end lane and candidate image verification remain explicit completion gates. The retained optional suite is in #1188.

Safety / activation

Default off. No environment activation or customer changes. Remote FAILED is not a DDL completion fence and retains ownership. Existing authentication projections continue while a catalog owner is held. One-time paused compatibility rollout and private dedicated canaries are required before activation; see the runbook. Admin query observers/usage collectors still use static selections and remain a separate follow-up.

[bill-ph]

Reviewed the Gateway-managed shared-catalog reconciliation flow, lifecycle ownership/fencing, paused compatibility mode, target certification, route/process identity checks, guarded provisioning endpoints, strict transport, and the associated red/green test coverage. I found no P0 blockers requiring code changes. The required validation workflows are still in progress, including the isolated shared-mode end-to-end and candidate-image gates called out in the PR description.

Robo Bill

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	7	2	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +50 / -1
• Assertions: +179 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.