feat: gate protected real feature reexecution

[zhouning]

Summary

• bind the exact M3-25 Chongqing 20-feature predecessor, including ResourceVersion/content, Iceberg/Parquet quality and GDA Control facts, to one deterministic admission contract
• compose the existing production identity and object-store gates, require both protected attestations to pass and bind the same source revision
• reject direct promotion of retained local material and require fresh protected ingestion through a separately approved execution
• keep scheduler submission, provider mutation, production ingestion and production_ready false even when re-execution eligibility eventually passes
• commit a self-validating pending decision, add ADR-072, advance roadmap/system-of-record, and wire validation/tests into CI

Checked decision

• contract SHA: 39411248b37b7d8d43ac7ad37737de15d6b6d4c5e4feb2088f0a87cec888b5f9
• decision SHA: 39246eacdd1793f23aecb71195cc4c9d8c63d7125aad8cd9bbb59a96c588cd73
• decision file SHA: 62624b96d83b085cbb82d29d618042d7f4faa5193847c26af859ec1c87cd4f11
• predecessor evidence SHA: 1b5a5ceeadee88868bab6237b3f3280c8b13793cc54193592fec7dbbfdd4e8a6
• identity profile SHA: 2e9d5cac3560b853820f923669f6794ead63bcb36a528639fc0e9539e148ee2f
• object-store profile SHA: 668e194b3c688307014148391e7f389c9d6e9ca69c95d7b4cc92b4acae93181a
• status: blocked_pending_protected_attestation
• blockers: 85 total, comprising 40 identity decisions, one missing identity attestation, 43 object-store decisions and one missing object-store attestation
• ready_for_protected_reexecution=false

The blocked result is the intended fail-closed state. No provider was contacted, no retained resource was modified, and no scheduler command, Run, PolicyDecision, Approval or authority fact was created.

Claim boundary

This establishes a content-bound protected re-execution admission gate. It does not select or deploy production identity/storage, produce protected attestation, authorize execution, verify production ingestion, prove backup/PITR or independent failure domains, or make the platform production ready.

Verification

• M3-26 decision validator: valid
• focused M3-26 + identity/object-store + M3-25 suites: 72 passed
• required-platform suite: 910 passed, 9 warnings
• Ruff and git diff --check
• M3-25 frozen implementation/script/evidence SHA checks
• JSON, Markdown link, local-path and sensitive-field checks

Stacked on #47.

Closes #48