feat(platform): establish read-only metadata fabric bridge

[zhouning]

Summary

• establish the AR-1 M1 read-only binding between one GDA ResourceVersion, one OpenMetadata table, and at least one Gravitino table
• fail closed on provider identity, owner, version, checksum, revision, duplicate or missing observation, deletion state, and secret-bearing payload drift
• freeze deterministic binding and reconciliation fingerprints in a synthetic land-use golden fixture
• add ADR-036, roadmap and system-of-record updates, plus the required CI validator and tests

Validation

• 24 focused tests passed
• 456 required-platform tests passed before final review
• metadata fabric validator passed
• Ruff check and format check passed
• CI YAML, fixture JSON, relative links, and git diff checks passed

Scope boundary

This is M1 contract evidence only. Provider operations are GET-only, writes_performed is fixed to false, and production_provider_verified is fixed to false. OpenMetadata and Gravitino live deployment, persistence, OIDC, backup and restore, upgrades, controlled ingestion and replay, OpenLineage, and Gravitino Spark, Sedona, and Flink conformance remain M2 and M3 work. This PR does not publish a container image or deploy to staging or production.