feat: add isolated Brio staging databases

[kaanyagci]

Summary

• provisions isolated Brio staging application and Keycloak databases with TLS, SCRAM, scoped roles, encrypted backups, and exact rollback
• makes canary and standalone identity database rollout crash-safe with transaction journals, bounded TTL cleanup, and failure-injection coverage
• adds a two-phase, idempotent release evidence chain with complete API pagination and no persistent bearer-token file
• validates six Keycloak realms after restore using a secret-safe configuration fingerprint and the exact checked-out Catwlk provider runtime
• replaces persistent public-repository CI execution with disposable, attested self-hosted jobs and crash-safe startup reconciliation
• codifies exact custom main deployment policies for every protected environment, including production

Validation

• PYTHONDONTWRITEBYTECODE=1 ./scripts/run-ci.sh
• 20 Node policy and attestation tests
• deployment guard, transaction, interruption, rollback, TTL, backup, and restore fixtures
• Stripe-independent Brio release evidence and Keycloak cohort evidence negative tests
• actionlint, shellcheck, Python syntax validation, config validation, and whitespace checks

The complete suite passes on the exact pushed head 62496a7aa4849d8c1016570a12fafb40292efcb5. All five new commits are GPG signed.

Remaining rollout gates

• bootstrap the protected pull_request_target workflow from default main; GitHub cannot execute a newly introduced target workflow against the PR that introduces it, so this head currently has no remote attestation
• reconcile the production environment to the exact custom branch main policy with the reviewed helper and preserve its reviewers
• install and verify the root-owned Keycloak capture dispatcher and cohort cleaner on the database host
• use the reviewed Keycloak 26.7.3 source SHA and exact Catwlk runtime, then complete the six-realm restore evidence
• complete the protected standalone database deployment and the separate Keycloak-path release attestation

No deployment, environment mutation, or credential-provider mutation is performed by this PR update.