Configure Launchplane workflow service identity

[cbusillo]

Summary

• Replaces hard-coded Launchplane hosted URL/audience literals in workflow runtime config with vars.LAUNCHPLANE_PUBLIC_URL and optional vars.LAUNCHPLANE_SERVICE_AUDIENCE.
• Adds optional launchplane_url / launchplane_audience inputs to reusable Odoo workflows while preserving default caller compatibility via repository variables.
• Documents the configured service identity contract and adds static regression coverage so workflows do not reintroduce production URL/audience literals.

Refs #1069
Refs #1049

Validation

• git diff --check
• uv run --extra dev ruff check tests/test_product_onboarding.py --diff
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run python -m unittest tests.test_product_onboarding
• docker run --rm -v "${PWD}:/repo" -w /repo rhysd/actionlint:1.7.12 -config-file .github/actionlint.yaml