test: lock catalog routing compatibility

[konstantinoscs]

What this does

This PR adds tests that capture how tower.tables() chooses a catalog today. It does not change production behavior.

The tests protect three important paths:

• Tower-managed catalogs use credentials supplied by Tower.
• S3 Tables and BYO catalogs keep using their existing PyIceberg configuration, for both reads and writes.
• A caller-provided PyIceberg catalog is used directly, without contacting Tower.

They also verify that a managed-catalog credential failure is reported instead of silently falling back to unrelated ambient credentials.

Why

The rest of this stack changes table behavior. These tests give us a stable compatibility boundary, especially for existing S3 Tables and BYO users.

Testing

• 17 new catalog-routing tests pass.

Stack

PR 1 of 5. Review this first. Next: #346.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7136eebb-fa1b-403c-8a57-da8f0691c15e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}