Filter runtime secret bindings by target route

[cbusillo]

Summary

• ignore unrelated-context managed secret bindings during runtime key-safety evaluation
• report binding_missing when all candidate bindings are outside the target route
• add a regression test for an OPW prod target not being satisfied by a CM prod binding

Validation

• uv run --extra dev ruff check --exit-zero control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run python -m unittest tests.test_runtime_key_safety
• uv run --extra dev ruff check control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run --extra dev mypy control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• git diff --check