Harden authorization authority boundaries

[cbusillo]

Summary

• keep PostgreSQL as live authorization authority and freeze new workflow/secret-owned grants
• harden managed reconciliation against lockout, self-revocation, readiness blockers, and managed-set confusion
• remove authorization reconciliation from deployment and preserve legacy human-policy semantics until explicit migration
• add authority documentation and behavioral coverage

Validation

• 12/12 Launchplane unittest shards passed after rerunning the three changed failing shards
• uv run --extra dev mypy control_plane tests
• changed-file Ruff lint and format checks
• config-authority audit: status ok
• independent Opus/Gemini/Sol security review blockers addressed

Readiness

Draft: JetBrains changed-file inspection remains red because the touched legacy files inherit a large existing inspection baseline. No production authorization change is included or authorized.

Relates to #2058
Relates to #2179