feat: expose native PyIceberg catalog access

[konstantinoscs]

Summary

• Add the public tower.load_catalog() API through the optional Iceberg feature.
• Resolve one Tower-managed catalog independently per call and return the unwrapped native PyIceberg Catalog.
• Default to read access, require explicit read-write mode for mutations, and keep provider credentials fixed for the returned handle.
• Map authentication, permission, not-found, unsupported-catalog, and connection failures to documented Storage exceptions.
• Remove the legacy automatic default-catalog provisioning retry.
• Document the API, authentication precedence, inheritance, and expiry behavior in the package reference.

Stack

• Depends on feat: cache resolved catalog access per private resolver #361, which owns the private resolver, access provenance, cache, and single-flight behavior.
• Canonical documentation: tower/tower-monorepo#1902.

Testing

• 134 focused Storage and Tables tests passed.
• 249 full-suite tests passed, 10 skipped.
• Black and mypy passed.
• Exact local dependency versions: PyArrow 23.0.1 and PyIceberg 0.11.1.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: aeefbd83-c73b-4f59-b3e5-c20de4fb583a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}