feat: assign protected profile owner decisions

[zhouning]

Summary

• bind the checked M3-26 protected re-execution decision and its 85 blockers
• assign every blocker exactly once to 16 dependency-ordered owner decision groups
• record profile paths, decision boundaries, required artifacts, and protected gate evaluation commands
• add a fail-closed checked packet, CLI wrapper, tests, ADR-073, roadmap/SoR updates, and CI validation

Validation

• 74 passed across M3-27, M3-26, identity, and object-store focused tests
• 919 passed, 9 warnings in the required-platform suite
• packet validator: valid, 85 expected/assigned/unique blockers, 16 unresolved groups
• Ruff check and format check passed
• wrapper syntax, JSON assertions, and git diff --check passed

Authority boundary

The packet does not choose an IdP, provider account, bucket, region, KMS key, or production owner. Every group remains unresolved and every scheduler, provider mutation, ingestion, and production claim remains false. It does not promote retained M3-24/M3-25 material and does not authorize fresh ingestion.

Stack

Base: feat/ar1-metadata-fabric-protected-real-feature-reexecution-gate / PR #49.

Closes #50