UC5: honour PP removal from a council end-to-end

[AquiGorka]

What

Part of the UC5 PP removal & continuity slice. This is the provider-stack (Rust single-PP standin) piece — it must honour its own removal, mirroring provider-platform's semantics in Rust.

How

All three paths converge on the council's authoritative GET /api/v1/public/provider/membership-status endpoint (200 ACTIVE / 202 PENDING / 404 REJECTED):

• Boot convergence (membership). Alongside the existing channel convergence, on boot the watcher asks the council whether this PP is still a member of each council it holds a row for. So a provider_removed that landed while the standin was down is honoured on boot even though the cursor is in-memory only. (event_watcher::run)
• Inbound notice. POST /api/v1/provider/council/removed — the council's low-trust live signal. No operator auth; it is not believed on its own. It triggers the same re-query+converge and demotes only what the council confirms is gone. The on-chain event-watcher (which already sets REJECTED on the provider_removed event) remains the can't-miss path; this just reacts immediately.
• Bundle gate. Once removed (a REJECTED membership and no surviving ACTIVE one), POST /provider/entity/bundles returns 403 so users move to a different PP. Gated only on an observed removal — never on the mere absence of a membership — so stacks operating without a council row are unaffected.

The convergence loop is extracted into core::pipelines::membership_convergence::converge_membership_statuses and reused by boot, the inbound notice, and the existing operator-driven post_membership sync (which now delegates to it — no behaviour change).

The contract is unchanged; remove_provider already emits ProviderRemoved, which the watcher already decodes into REJECTED.

Tests (TestDb + wiremock)

• council_removed_http.rs: convergence demotes to REJECTED on 404 (the boot/downtime case); leaves an ACTIVE membership untouched on 200; the inbound POST /provider/council/removed endpoint demotes (202, deactivated:1).
• bundle_submit_http.rs::removed_from_council_rejects_new_bundles: a bundle that would be 201 while active is 403 once removed.
• Existing event_watcher_tick::provider_removed_event_marks_membership_rejected and council_http tests still pass (the post_membership refactor is behaviour-preserving).

Run locally with CI's exact toolchain (cargo 1.96.0 / rustfmt 1.9) and flags: cargo fmt --check, cargo clippy --workspace --all-targets --no-default-features -- -D warnings, cargo test --workspace --no-default-features against a throwaway postgres:18, and cd frontend && deno task build — all green. (The docker-smoke image build re-assembles these same validated artifacts and was not run locally.)

Version: 0.1.2 → 0.1.3 (Cargo.lock synced).

Coordination

Completes the slice with council-platform (outbound notify on removal) and provider-platform (inbound notify endpoint).