feat: reconcile active metadata provider binding

[zhouning]

Summary

• validate the checked M3-18 Chongqing projection evidence and exact retained OpenMetadata UUID/FQN/version/content/governance/snapshot before provider mutation
• repair only an absent Gravitino target; reset the dedicated M3-18 memory catalog only when its configuration is exact and its visible schema inventory is empty
• require Gravitino-only mutations, immediate no_op/0 mutations replay, and the original M3-18 binding SHA before committing through PlatformGateway
• persist one tenant-scoped immutable binding with idempotent replay, FORCE RLS, append-only grants, direct mutation rejection, and cross-tenant isolation
• add checked evidence, ADR-065, Platform Truth/System-of-Record/Roadmap updates, PostgreSQL regression, and required CI

Real rehearsal

• real Chongqing content SHA: fd474fd65c8e4a71da241eb3fd07748ca3b972fbd2d3c32833376dbe71104007
• retained OpenMetadata UUID: 9d043410-02b5-487d-bb70-da5f3969a978; OpenMetadata mutations: 0
• Gravitino mutations: stale empty memory-catalog reset, catalog create, schema create, table create
• immediate replay: no_op/0 mutations
• binding SHA: 7de24cee9dd50dfeefcc886cf43024f4d92b7650767d71d064fdce19ffccb16b
• first binding commit: created=true; replay: created=false; row count: 1
• DolphinScheduler: SUCCESS; PlatformRun: reconciling
• callback, two port-forwards, standalone container, and temporary database cleanup verified
• evidence SHA: e6d0e3ac4e052029dad0c18d0804626a8af61554a54081c37d8cc9a80c55cd33

Verification

• 842 passed in the required platform suite
• 38 passed across focused M3-19/M3-18/binding regression before documentation integration
• 32 passed across M3-19, binding, M3-18, and Platform Truth after integration
• fresh PostgreSQL M3-19 regression: 1 passed
• M3-19 evidence validator: valid, errors=[]
• Platform Truth validator: valid
• focused Ruff, py_compile, and git diff --check: passed
• final live Gravitino table read-back returned code=0 with the exact ResourceVersion/content/revision

Claim boundary

• durable_catalog_verified=false
• protected_workload_identity_verified=false
• provider_minimum_privilege_verified=false
• production_ingestion_verified=false
• production_ready=false
• PlatformRun remains reconciling, never succeeded

Stacked on #32. Closes #33.