feat: execute active metadata projection through scheduler

[zhouning]

Summary

• execute one authorized Chongqing Active Metadata projection through official DolphinScheduler 3.4.2 and an ephemeral local projection executor
• reuse the existing OpenMetadata and Gravitino apply clients with an independent metadata_fabric.apply authorization, exact provider read-back, and a zero-mutation replay
• add ADR-064, committed evidence, Platform Truth inventory, roadmap/System-of-Record updates, CI validation, and focused tests

Verification

• local real-provider rehearsal: scheduler SUCCESS, one callback, 10 first-apply mutations, replay no_op with 0 mutations
• required platform suite: 831 passed
• focused M3-2/M3-17/M3-18/Platform Truth suite: 39 passed
• M3-18 evidence validator and Platform Truth validator: valid
• Ruff on new Python files: passed
• callback, port-forwards, standalone container, and temporary database cleanup: verified

Claim boundary

This is local Docker Desktop evidence. PlatformRun remains reconciling. Protected workload identity, provider-wide minimum privilege, Gravitino authentication, OIDC/TLS, production scheduler/executor, persistent binding, production ingestion, and production_ready remain false.

Stacked on PR #31. Do not merge independently from the lower stack.