Re-home the Wedding backup denial proof and remove cutover tooling that needs the retired shared store #4480

🤖 Generated by the Agentic Engineer

Evidence

#3253 retires the Wedding tenant's access to the shared backup credential: the wedding-db ObjectStore and the wedding-db-backup-r2 Secret leave the wedding-app namespace. Three operator tools were written for the cutover and assume both still exist there:

• Verify Wedding Backup Denial (scripts/verify-wedding-backup-denial.sh and its pod script) mounts the shared credential next to the dedicated one, as the positive control and to check that a refused write left no trace. It passed once before retirement (run 37234932425) and cannot pass again in its current form. docs/dr/runbook.md Scenario 7 still wants this proof after every rotation of the dedicated token.
• Mirror Wedding Backup Catalogue (workflow, two scripts, a Go evaluator, about 2,300 lines with tests) copied the shared catalogue into the dedicated bucket. The copy and the catch-up are complete (Mirror the shared Wedding backup catalogue into the dedicated bucket and prove parity #3767, Switch the Wedding database to the dedicated backup store and prove new backups land there #3768).
• Recover Wedding DB Incident (workflow and script, about 1,100 lines with tests) is pinned to the object identities of the 2026-09-09 incident and to the shared store. Its last successful run was on 2026-09-13.

All three now refuse at their first precondition. That is safe, but CI still runs their fixture suites on every pull request, and the runbook names a proof nobody can run.

Expected outcome

A dedicated-token rotation can again be followed by an observed denial, without the tenant namespace ever holding the shared credential, and the repository no longer carries one-shot tooling that cannot run.

Acceptance criteria

• The denial proof runs again with the shared credential kept out of the wedding-app namespace (for example from a platform-owned namespace that already holds it, using a run-owned copy of the lower-privilege dedicated credential), keeping its positive controls and its no-trace check.
• A protected main run of the re-homed proof reports the denial.
• The catalogue mirror and the incident recovery tooling are removed, with their CI steps, or a recorded reason keeps them.
• docs/dr/runbook.md, docs/dr/velero-cnpg.md and docs/dr/restore-drill.md describe only tooling that can run.

Blocker: none — follows #3253's retirement change.