feat: bind active metadata promotion to object store

[zhouning]

Summary

• preserve M3-20/M3-19 history and bind the predecessor promotion candidate into an independent JDBC catalog backed by cross-node MinIO
• project the real Chongqing ResourceVersion with a bounded Gravitino principal, then prove immediate and post-restart no-op replay
• verify the exact Iceberg metadata object directly through S3 and commit path-free evidence, ADR-067, Platform Truth inventory, System-of-Record updates, and required CI coverage

Real data evidence

• ResourceVersion: a6000000-0000-4000-8000-000000000001
• content SHA-256: fd474fd65c8e4a71da241eb3fd07748ca3b972fbd2d3c32833376dbe71104007
• retained OpenMetadata UUID: 9d043410-02b5-487d-bb70-da5f3969a978
• predecessor candidate SHA-256: bb6672cb7f98fa53305e17bbca2cb5b3756d4a335a94d79114fb4184273871d1
• new promotion candidate SHA-256: 63812c311b3f239bc6a944748c4ff384250eb9c9ed9009d3384fc699f1d3eaa9
• source data and absolute local paths are not committed

Verification

• M3-21, M3-20, M3-10, and Platform Truth validators pass
• required platform suite: 866 passed
• Ruff, compile, and staged diff checks pass
• exact S3 key, ETag, body SHA, and table schema remain stable across restart
• namespace, PostgreSQL/MinIO PVs, and port-forwards are cleaned

Boundaries

This proves local same-host cross-node JDBC/S3 metadata promotion and restart continuity only. No Chongqing feature rows are ingested, and the candidate is not written to GDA Control. Production object storage, protected workload identity, OIDC, TLS, durable catalog, Spark/Flink conformance, production ingestion, and production_ready remain false.

Stacked on #36. Tracks #37.