Add ingress audit read workflow

[cbusillo]

Summary

• add a manual Ingress Route Audit Read workflow for OIDC-authenticated GET reads of ingress route audit records
• keep the workflow canary-scoped through the existing ingress_route.plan authority and deploy-time grant
• redact workflow output/artifacts so raw audit records with provider or route details stay runner-local
• document the public/private boundary for audit-read artifacts and private infra topology

Verification

• uv run python -m unittest tests.test_product_onboarding.ProductOnboardingTests.test_ingress_route_audit_read_workflow_is_plan_scoped_get
• uv run python -m unittest tests.test_product_onboarding
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run --extra dev ruff format --check tests/test_product_onboarding.py
• docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.12 -config-file .github/actionlint.yaml
• git diff --check

Refs #1051