feat(platform): rehearse Gravitino JDBC catalog restart

[zhouning]

Summary

• add an isolated authenticated Gravitino 1.3.0 Iceberg JDBC catalog backed by PostgreSQL and a separate warehouse PVC
• prove PostgreSQL then Gravitino restart continuity with changed Pod UIDs, stable StatefulSet/PVC UIDs, identical table projection, preserved bounded role, and persistent 403 catalog-create denial
• add fail-closed profile, manifest, evidence validator, 20 focused tests, runtime inventory registration, ADR-054, roadmap/System-of-Record updates, and required CI coverage

Evidence

• contract fingerprint: f622d8a61bae49171bc76a16bfe64280c616c028bddf88479f1ad04acb1dadf0
• evidence fingerprint: 34792bb47ad71041a87adeb644439bf9b6aa3f4855cdc98782d6e3b4282bf1aa
• table projection fingerprint remained 25845cd3890a9e4dc1663cf9e77bfe6a63144223d29ab788f12af6448d0717a3
• temporary namespace and persistent volumes were removed after the rehearsal

This is local Docker Desktop Basic/HTTP/file-warehouse continuity evidence only. Protected workload identity, OIDC, TLS, production persistent identity binding, Spark/Flink conformance, production ingestion, and production_ready remain false.

Verification

• live Docker Desktop Kubernetes rehearsal: passed
• checked evidence validator and integrity verifier: passed
• focused M3-8 tests: 20 passed
• M3-6/M3-7/M3-8 identity tests: 54 passed
• platform truth plus M3-8 tests: 31 passed
• required platform suite: 675 passed
• Python compile, Shell syntax, Kustomize render, CI YAML parse, and diff checks: passed

Stacked on PR #21.