Release-gate: ambiguous metadata fails closed (PR 5 of 5 of epic #2341)

[brendancol]

Reason or Problem

Epic #2341's acceptance criteria include: "Unsupported or ambiguous metadata fails loudly instead of flattening or guessing." Today, several near-ambiguous cases are tested in scattered files (e.g. test_ambiguous_metadata_hooks_1987.py, test_allow_rotated_geotiff_2115.py, test_allow_rotated_no_crs_2122.py), but no single regression test pins the release-gate promise that the entire family of ambiguous-metadata cases fails closed with an actionable message.

Proposal

Add xrspatial/geotiff/tests/test_release_gate_negative_2341.py.

Parametrized negative cases:

1. Conflicting CRS between header and .aux.xml sidecar: open should raise with a message naming both sources and the configured resolution policy (or a way to override).
2. Integer nodata on a float-promoted raster: open should raise (or refuse to coerce) rather than silently masking with the wrong sentinel.
3. Rotated transform without allow_rotated=True: open raises with an actionable message naming the flag — already covered for some paths; this test ensures every promised read entry point (eager, dask, windowed) raises uniformly.
4. Mixed-tier VRT children when stable-only is requested: if a VRT references a child whose codec is experimental, the open call refuses with a message naming the offending child and the flag to opt in.

Each case asserts:

• The raised exception type matches the project's existing convention for input-rejection (e.g. ValueError or a project-specific subclass).
• The exception message contains the name of the option/flag that would unlock the call, the feature tier, and a pointer to the release-contract doc.

Assertions inlined per-file. Add a row to docs/source/reference/release_gate_geotiff.rst under "Cross-cutting CI gates" citing the new file.

Stakeholders and Impacts

Touches one new test file. If any of the four cases is currently NOT failing closed, the corresponding fix is in scope — the test pins the release promise, and a regression here is a release blocker.

Out of scope: VRT subset definition (epic #2342), the experimental-codec opt-in policy itself (#2352).

Drawbacks

Case 4 (mixed-tier VRT children) depends on VRT epic #2342 having defined the "stable-only" knob. If that knob does not yet exist, this PR ships cases 1-3 and leaves case 4 as a follow-up TODO with an xfail marked against #2342.

Alternatives

• Split each case into a separate PR. Rejected: the negative tests are small, the assertions are uniform, and bundling them keeps the release-gate citation row pointing at one file.

Additional Notes or Context

Parent epic: #2341. PR 5 of 5. Sibling issues: #2357 (PR 1), #2358 (PR 2), #2359 (PR 3), and PR 4 (to be filed).