feat: apply the database catalog in the cluster by its engine's method

[ExtraToast]

Summary

A project on the estate path gets its database, its owner and data roles and the Vault database roles that issue its logins without anyone running cluster.sh (#444).

• Platform document. An engine names its catalog method, an image alias (E_UNLOCKED_IMAGE otherwise). A legacy datastore's serving location names admin, where the old path keeps its administrative login.
• What renders. For each datastore whose engine names a method, beside the Vault policy job, the estate-scoped artifact holds <process>-catalog. It runs as a Job and an hourly CronJob in the datastore's namespace, inside estate-vso-secrets, so no Application that reads a database starts first. Its ConfigMap hands the method the catalog: host, port, connection, admin login, and one <project>_db / <project>-owner / <project>-data per estate-path project that reads from the datastore. A legacy project is left out, so the estate path never takes over a database the old path still owns.
• Its Vault rights are rendered. The method's identity gets its own policy (read its login, write exactly the database roles its catalog names) and auth role. The policy job writes them like any identity's, so policy-admin does not widen.
• Naming. The Job is named by the digest of the catalog and what its pod runs with, so a new catalog or a new image is a new Job.
• One owner per ServiceAccount. The render now refuses two objects that claim one ServiceAccount (E_PATH_COLLISION). A Vault role binds the account's name alone, so a Process named like a derived identity (-backup, -migration, -catalog) would otherwise hold that identity's role.
• Spec and docs. Chapters 14, 16, 20 and 30, ADR 0102, CONTEXT.md and REQ-061 state it, in both implementations. The worked knowledge-platform tree shows it: the example ledger moves knowledge-platform to estate and names Postgres's admin login. Every other oracle moved only by the changed input digests.

The method image itself, which creates and adopts the databases, comes next in JorisJonkers-dev/delivery. Until the estate's Platform document names catalog, nothing here renders in production.

Verification

• npm run verify passes. New tests cover the catalog's readers, a legacy project left out, no method or no login rendering nothing, the derived login once the datastore moves, the job being handed to the policy job, a new image giving a new name, an unlocked method, and a Process taking a derived identity's account.
• ./mvnw clean verify under emf/ passes, rendering the knowledge-platform tree byte for byte; the hand-written models changed only by input digests.

Closes #447

[github-actions]

Shape

bucket	files	additions	deletions
production code	18	+829	-35
tests	2	+304	-0
specification	6	+351	-1
decision records	2	+86	-0
documentation	3	+10	-2
examples	22	+302	-19
tooling	2	+6	-6

Coverage

Baseline: main @ 526d5c9.

metric	this branch	main	diff
statements	99.57%	99.56%	+0.01
branches	98.40%	98.38%	+0.02
functions	100.00%	100.00%	0.00
lines	99.52%	99.51%	+0.01

Lines this pull request changed: 82/82 covered (100.00%).