feat(platform): gate production object-store readiness

[zhouning]

Summary

• add a fail-closed production object-store profile and protected attestation gate
• bind the verified M3-10 Spark/MinIO evidence and freeze provider, workload identity, TLS, KMS, durability, consistency, tenancy, recovery, and operations requirements
• add 32 focused tests, CI integration, ADR-057, and system-of-record roadmap updates

Claim boundary

• this is a decision and verification contract only; it does not select or deploy a provider
• the checked-in profile is valid but exposes 43 explicit production blockers
• all production object-store claims and overall production_ready remain false until an approved profile and fresh protected-environment attestation exist
• native non-S3 providers require a separate conformance slice

Validation

• 30 CI validators passed
• required platform suite: 741 passed
• focused object-store gate suite: 32 passed
• route evaluation contract: 41 passed
• PostgreSQL boundaries: 5 passed
• frontend production build passed
• module compilation and git diff --check passed

Stacked on #24. Do not merge until the parent stack is reviewed.