Scope local operator product config grants

[cbusillo]

Summary

• replace default wildcard local-operator product-config grants with catalog-derived product/context scopes
• allow explicit scope override through LAUNCHPLANE_LOCAL_OPERATOR_PRODUCT_CONFIG_SCOPES_JSON
• add a capture-style regression test that runs the deploy grant script and verifies product-config grants are not */*
• document routine local-operator product-config scope behavior

Refs #1067
Refs #1049
Refs #1041

Validation

• git diff --check
• shellcheck scripts/deploy/ensure-authz-grants.sh
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run python -m unittest tests.test_product_onboarding