feat(platform): rehearse Gravitino provider identity

[zhouning]

Summary

• run an isolated Gravitino 1.3.0 Basic IdP and PostgreSQL identity rehearsal in Docker Desktop Kubernetes
• prove exact USE_CATALOG, USE_SCHEMA, and CREATE_TABLE grants with an allowed table probe and denied catalog-create probe
• prove administrator password reset and IdP user deletion invalidate the exercised login, then delete the entire temporary namespace
• bind the local evidence into ADR-052, roadmap, system-of-record, runtime inventory, and required CI

Evidence boundary

This proves only local Gravitino Basic identity, bounded table-create scope, login rotation, revocation, and cleanup. OIDC, TLS, protected workload identity, cross-provider production minimum privilege, persistent production catalog, and production readiness remain false.

Evidence fingerprint: f0b0de1f80f079d43318937e0a0cc151a8546e9e307bef204738b1367f9b29fd

Verification

• ./scripts/metadata-fabric-gravitino-identity.sh rehearse --evidence-out docs/evidence/metadata-fabric-gravitino-identity-2026-07-28.json
• ./scripts/metadata-fabric-gravitino-identity.sh validate
• focused identity and platform-truth tests: 19 passed
• required platform suite: 629 passed
• all existing metadata-fabric validators passed
• Kustomize render and git diff --check passed
• temporary namespace and port-forward processes absent after rehearsal

Stack

Depends on #19 (feat/ar1-metadata-fabric-provider-identity). Please review and merge #19 before retargeting or merging this PR.