Bound local operator product-config grant scopes

[shiny-code-bot]

Summary

• remove the deploy-time fallback that derived local-operator product-config grant scopes from the seed import catalog
• pass the optional explicit local-operator product-config scope JSON repo variable into the deploy grant reconciler
• document that seed catalogs are not deploy-time authority for routine operator grant scopes
• add tests for skip-by-default, configured scopes, and malformed explicit scope JSON

Refs #1049

Validation

• git diff --check
• bash -n scripts/deploy/ensure-authz-grants.sh
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run python -m unittest tests.test_product_onboarding
• docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.7 -config-file .github/actionlint.yaml .github/workflows/deploy-launchplane.yml
• JetBrains changed-file inspection: clean

Operator note

Deploy now skips local-operator product-config grant reconciliation when LAUNCHPLANE_LOCAL_OPERATOR_PRODUCT_CONFIG_SCOPES_JSON is unset or empty. Set that repo variable with explicit product/context scopes when routine local-operator product-config write access should be reconciled during deploy. Malformed explicit JSON fails the deploy grant step.