feat: prove retained real feature terminal success

[zhouning]

Summary

• execute the checked Chongqing 20-feature Spark/Sedona JDBC/S3 Iceberg ingestion through a real DolphinScheduler Shell task
• persist complete execution-plan, PolicyDecision and Approval Artifacts, independently re-evaluate the retained Parquet, atomically promote the output bundle, and let the existing database finalizer reach succeeded@3
• retain namespace/PVC/MinIO-Iceberg material and dedicated GDA Control PostgreSQL for seven days under an identity-bound cleanup contract
• register the rehearsal in platform truth, add ADR-070, advance roadmap/system-of-record, and wire validator/unit/PostgreSQL tests into CI

Live evidence

• contract SHA: 9c8f20ca1fb9995530c4e988ced627f665857ecdf0e104bb7d07c4a4a486057a
• evidence SHA: d966668b5a2ea57c7a4b2a3bc9824daab9b0128d9f94e515d7be649b145de418
• output content SHA: bdc06792e8b935176ee6df6f6f6d4be1535622d54d9b994a778cabfe5a574618
• row-set SHA: c26ff708f4b6be082327dff63a6a8659420dbc4cab37dea1cac7b40f147512df
• retention ID: m3-24-229740ac50ebb53b
• expiry: 2026-08-07T04:15:23.082316Z
• real provider state: DolphinScheduler SUCCESS
• final Run: succeeded@3, exact terminal replay adds no facts

The source payload ConfigMap and temporary scheduler were removed. Retained resources remain available for audit and must not be cleaned early. The recorded bounded command is cleanup --retention-id m3-24-229740ac50ebb53b.

Production boundary

This is retained local staging evidence, not production. Protected workload identity, production object storage and tenant attestation, persistent scheduler/executor, independent failure domains, backup/PITR, restart/recovery, scale/conformance and production_ready remain false.

Verification

• ./scripts/metadata-fabric-retained-real-feature-terminal-success.sh validate
• required-platform suite: 896 passed
• all PostgreSQL control-ledger suites: 15 passed
• focused M3-24/platform truth suite: 19 passed
• Ruff on new M3-24 code and platform truth test
• Markdown link and sensitive-value checks

Stacked on #43.

Closes #44