feat: atomically promote real feature ledger bundle

[zhouning]

Summary

• add a content-bound RunOutputLedgerPromotion and dedicated promoter that appends ResourceVersion, output Artifact, quality evidence Artifact, passed QualityResult and LineageEvent under one existing PlatformGateway transaction
• reject missing authority, prerequisite drift, partial pre-existing state and non-accepted/non-reconciling Runs while preserving exact replay
• verify rollback, FORCE RLS, minimum grants, tenant isolation, append-only controls and terminal-success rejection against PostgreSQL 16
• preserve the byte-exact platform_gateway.py used by the M3-14 through M3-17 evidence chain
• register the local-only runtime, CI gates, ADR-069, evidence and roadmap/System-of-Record status

Verification

• Platform Required Tests: 888 passed
• PostgreSQL control-plane suites: 11 passed
• M3-23 checked validator: valid
• All CI static validators: passed
• Ruff focused checks: passed
• git diff --check: passed
• changed Markdown links: resolved
• sensitive/source material scan: clean
• Promotion SHA: 404b6e4e5d8194f092bd83ef99cbf2d1d727015b926cd438a79eb0210f969a22
• Contract SHA: bd21c81925f66acdfecca5cabd78651f31deab4165da2ccd6900c4e5796e5735
• Evidence SHA: f6efea5000791dec1716a8354a8e39a8425b083ca4d409f4bcb61f0e7e03580d

Boundaries

This proves a local control-plane commit against checked M3-22 candidates. The M3-22 object-store material and M3-23 evidence databases are not retained. Complete authorization Artifacts, independent quality-evidence provenance and a successful FrameworkAttemptObservation are absent, so PlatformRun remains accepted at state version zero and success finalization is deliberately rejected. This does not claim staging or production ingestion, protected identity, durable catalog, production object storage, tenant-isolation deployment or production readiness.

Stacked on #41.

Closes #42