feat(provider): define the versioned provider interface for multi-engine support

[devantler]

🤖 Generated by the Agentic Engineer

First child of #33, and the one that must land first — every other driver child is written against the contract this defines.

User story

As a controller developer, I want engine provisioning expressed behind one versioned Go interface so that adding an engine does not mean editing reconcile logic, and so native and cnpg-hybrid are two implementations of one contract rather than two code paths.

🔴 Resolve the architecture fork first

This child is where #33's overlap with #3 gets settled, because the interface shape is the decision:

• If engines are delegated (Provision new data sources through pluggable resource references #3's direction), this interface describes an adapter over a provisioner-owned resource plus a Secret-backed connection contract, and the CR keeps carrying references rather than storage.size.
• If engines are in-controller (feat: Implement multi-engine provider support (Native + CNPG Hybrid) #33's direction as written), it describes a driver that reconciles engine resources directly.

Do not start the driver children until this is decided and recorded on #33. Closing or re-scoping #3 is part of that decision.

Acceptance criteria

• A versioned provider interface exists, with type (sql / document / graph) and provider (native / cnpg-hybrid) resolving to exactly one implementation, and an unknown combination failing validation at admission rather than at reconcile.
• The interface covers the full lifecycle the existing controller already reports on: create, readiness, connection-contract publication, and deletion/ownership semantics.
• Credentials remain outside the CR — a Secret-backed connection contract, consistent with Provision new data sources through pluggable resource references #3 and the README.
• CRD schema changes are additive and do not break the existing spec.id / outputs / inputs / ui contract; existing DataProduct resources continue to reconcile unchanged.
• Behind a default-off feature flag, tested in both states, with a flag-removal issue filed.
• The chosen architecture and the disposition of Provision new data sources through pluggable resource references #3 are recorded on feat: Implement multi-engine provider support (Native + CNPG Hybrid) #33.

Rough size: M, and it gates the rest.