feat(platform): establish AR-1 control and staging evidence chain

[zhouning]

Summary

• establish fail-closed schema, configuration, runtime, resource, run, authorization, quality, and lineage authorities for the next-generation data platform
• add the DolphinScheduler 3.4 adapter, durable command outbox, managed worker, callback correlation, deployment contract, and activation gates
• add staging candidate, live observation, immutable release bundle, GHCR subject, protected provenance, and attested release evidence boundaries
• document the AR-0/AR-1 roadmap, system-of-record matrix, operational procedures, and the proposed GitHub mainline history recovery

Review Boundary

• base: feat/v12-extensible-platform@ebd99f8
• head: feat/ar1-dolphinscheduler-adapter@b55a235
• 26 commits with a real common ancestor; this PR does not merge the unrelated legacy main history
• production promotion remains blocked; no workflow in this PR claims that staging or production is deployed

Verification

• 34 staging candidate/registry/provenance/release/live evidence tests passed
• Ruff, Python compileall, YAML parsing, Actionlint v1.7.12, and git diff --check passed for the latest release-evidence slice
• Docker Desktop kind evidence and PostgreSQL transaction-boundary evidence are documented in the linked ADRs and roadmap

Remote Preconditions

• repository ruleset protects both the legacy main and active feat/v12-extensible-platform lineages from deletion/non-fast-forward updates and requires PRs
• staging-provenance requires reviewer approval, disallows administrator bypass, accepts only protected branches, and has environment-level GDA_STAGING_PROVENANCE_PROTECTED=true
• archive branches and annotated tag preserve main@f339e13 and the pre-AR1 active lineage

Remaining External Evidence

• CI results on this PR
• owner acceptance of ADR-035 before any branch rename/default-branch switch
• first real GHCR candidate publish and protected provenance verification after canonical main is restored
• protected staging overlay, immutable infrastructure digests, real cluster apply, live golden slice, and rollback evidence