feat(platform): add durable active metadata consumer

[zhouning]

Summary

• stack on feat(platform): add active metadata change outbox #28 and persist deterministic MetadataActivationRequest records before completing metadata change events
• add a managed PostgreSQL-only credential consumer/worker with an explicit enable gate, health status, zero-replica Kubernetes base, and no provider or scheduler secrets
• keep every request awaiting authorization with provider, scheduler, ingestion, and production claims fixed false
• commit PostgreSQL rehearsal evidence, ADR-061, CI, runtime inventory, roadmap, and system-of-record updates

Verification

• 812 Platform Required Tests passed
• 7 PostgreSQL contract tests passed, including atomic request staging and the M3-14 regression suite
• migration, gateway, platform truth, M3-14/M3-15 evidence, deployment, Kustomize, YAML, and diff validation passed
• Ruff passed for all new M3-15 Python files

Scope boundary

This proves local durable inert request staging and a fail-closed deployment contract. The base remains at zero replicas. It does not deploy the consumer, verify protected workload identity, create a DolphinScheduler command, authorize provider apply, execute provider mutations, or claim production ingestion/readiness.