Add public ingress synthetic monitoring

[cbusillo]

Summary

• add Launchplane-owned public ingress observation records, storage, migration, CLI, and run-once service route
• make generic-web and inherited drivers default-on for public base/health URL monitoring, with lane opt-out and runtime identity comparison when evidence exists
• add scheduled Public Ingress Monitor workflow, authz grant reconciliation, read-model surfacing, docs, and transition issue notifications

Validation

• actionlint .github/workflows/public-ingress-monitor.yml
• uv run --extra dev ruff check control_plane tests
• uv run --extra dev mypy control_plane tests
• uv run python -m unittest