feat(platform): verify provider-native metadata metrics

[zhouning]

Summary

• add a fail-closed local profile and collector for OpenMetadata Dropwizard/Prometheus and Gravitino Dropwizard metrics through explicit-context loopback port-forwards
• retain only allowlisted health/capacity values plus metric name/type/label-key inventory fingerprints; reject missing required metrics, sensitive fields, provider drift, and cleanup failures
• register the short-lived collector as local_verification_only, update the runtime primitive baseline, and add required CI validation/current-evidence tests
• add ADR-041 and update the roadmap and system-of-record matrix for Metadata Fabric M2c-1

Live evidence

• context/namespace: docker-desktop / gda-metadata-sandbox
• collection duration: 3.772s; both port-forwards stopped
• OpenMetadata Dropwizard: 111 gauges, 10 counters, 3 histograms, 24 meters, 16 timers; health 1/0; database connections 20/20
• OpenMetadata Prometheus: 160 metric families, 417 samples, 4 metric types, 23 label names; all four required families present
• Gravitino Dropwizard: 76 gauges, 680 meters, 152 timers; datasource connections 0/100; HTTP threads 8; JVM heap within max
• contract: 55961f899a66fb22934ecda924e4f41e228a562c00314737bdf0f9eee1210b05
• evidence: ba1ad18deedb4bcc134aa5b413e3e0c03c0b5bf931bae736adc425a8dbceeefc

No provider resources were changed and no Kubernetes credential-bearing resources were requested.

Validation

• required platform tests: 500 passed
• PostgreSQL ledger/gateway tests: 3 passed in the same independent-process layout used by CI
• final provider metrics/platform truth tests: 20 passed
• runtime dependency constraints: 4 passed
• all 14 static validators, Python compile, shell syntax, CI YAML parse, evidence verification, and git diff check passed
• npm ci with an isolated cache and the production frontend build passed

Claim boundary

local_provider_metrics_verified=true is limited to a point-in-time read of provider-native endpoints in the local Docker Desktop cluster. Production metrics, continuous scraping, an OTel pipeline, TLS, retention, tenant isolation, alert delivery, SLOs, OIDC, NetworkPolicy enforcement, upgrades, GDA writes, and production readiness remain false.

Stack

This PR is based on #8 and should be reviewed/merged after #8. It does not merge or modify #8 automatically.