Add provider target operations workflow

[cbusillo]

Summary

• add POST /v1/provider-targets/operations for Launchplane-scoped provider-target audit, dry-run, and apply operations
• add the manual Provider Target Operations workflow for Phase Two audit/backfill evidence, with ordered initial targets and apply confirmation guard
• reconcile workflow authz grants during Launchplane deploy and document the service-backed shared/prod boundary

Verification

• uv run python -m unittest tests.test_provider_target_audit tests.test_provider_target_backfill tests.test_product_onboarding_service tests.test_service.LaunchplaneServiceTests.test_provider_target_operation_endpoint_backfills_route tests.test_service.LaunchplaneServiceTests.test_provider_target_operation_endpoint_rejects_apply_without_authz
• uv run python -m unittest
• uv run --extra dev ruff check --diff control_plane/provider_target_operations_http.py control_plane/service.py tests/test_service.py
• uv run --extra dev ruff check control_plane/provider_target_operations_http.py control_plane/service.py tests/test_service.py
• uv run --extra dev ruff check .
• uv run --extra dev mypy control_plane/provider_target_operations_http.py control_plane/service.py tests/test_service.py
• uv run --extra dev mypy control_plane tests
• shellcheck scripts/deploy/ensure-authz-grants.sh
• yamllint .github/workflows/provider-target-operations.yml
• actionlint -config-file .github/actionlint.yaml .github/workflows/provider-target-operations.yml
• markdownlint-cli2 docs/operations.md docs/records.md docs/service-boundary.md
• prettier --check docs/operations.md docs/records.md docs/service-boundary.md .github/workflows/provider-target-operations.yml .github/github.json