feat(platform): gate production NetworkPolicy readiness

[zhouning]

Summary

• add a fail-closed production NetworkPolicy profile for cluster, CNI, DNS, workload identity, tenant isolation, provider traffic, logging and rollback decisions
• require a fresh profile-bound protected-environment attestation before deriving the production NetworkPolicy gate result
• add 23 focused tests, CI validation, ADR-046, roadmap and system-of-record updates

Claim boundary

• checked-in profile is valid but has 62 explicit production blockers
• no NetworkPolicy is deployed and OpenMetadata/Gravitino are not modified
• local kindnet evidence is not promoted to production evidence
• production_network_policy_gate_passed and production_ready remain false

Verification

• 566 required platform tests passed
• all Metadata Fabric validators passed
• ruff check and format check passed
• frontend production build passed

Stacked on #13; do not merge before its base is available.