feat(platform): rehearse metadata provider identity

[zhouning]

Summary

• provision an ephemeral non-admin OpenMetadata bot with one project policy that grants only table Create
• prove table create/read succeeds while policy creation is rejected with HTTP 403
• rotate the provider JWT and prove the old token fails, then revoke the replacement and prove it fails
• clean up the temporary table, bot, user, role, policy and denial probe, without retaining credentials in evidence
• add ADR-051, retained evidence, runtime truth, roadmap, system-of-record and CI coverage

Verification

• required platform suite: 621 passed
• focused provider identity and platform truth tests: 19 passed
• provider identity contract/evidence validate and verify: passed
• platform truth: valid, 25 runtimes, no unregistered primitives
• git diff check: passed
• ruff: not available in the local environment

Claim boundary

This proves a bounded local OpenMetadata provider identity and provider-native JWT rotation/revocation. The local minimum-privilege claim is limited to the project grant above the provider-mandatory DefaultBotRole. Gravitino authentication, protected workload identity, OIDC, production credential delivery, provider-wide minimum privilege and production readiness remain false.

Stack

This M3-5 PR is based on feat/ar1-metadata-fabric-openlineage-delivery so its diff contains only the provider identity capability. It must not be merged automatically.