Cut over provider-target authority reads

[cbusillo]

Refs #1104

Summary

• make physical ProviderTargetRecord rows the only current provider-target authority for Postgres reads, lists, lane summaries, and product target summaries
• cut generic-web Dokploy deploy resolution over to provider-target identity while keeping selected-lane Dokploy records as execution config
• fail closed on missing provider-target authority or Dokploy identity mismatch, and avoid cross-lane Dokploy orphan blast radius
• update docs for identity authority versus provider execution config

Validation

• uv run --extra dev ruff check control_plane/contracts/lane_summary.py control_plane/contracts/product_environment_read_model.py control_plane/storage/postgres.py control_plane/workflows/generic_web_deploy.py control_plane/workflows/generic_web_deploy_provider.py tests/test_generic_web_deploy.py tests/test_postgres_store.py tests/test_product_environment_read_model.py tests/test_service.py
• uv run --extra dev ruff format --check control_plane/contracts/lane_summary.py control_plane/contracts/product_environment_read_model.py control_plane/storage/postgres.py control_plane/workflows/generic_web_deploy.py control_plane/workflows/generic_web_deploy_provider.py tests/test_generic_web_deploy.py tests/test_postgres_store.py tests/test_product_environment_read_model.py tests/test_service.py
• uv run --extra dev mypy control_plane tests
• npx --yes markdownlint-cli2 docs/records.md docs/service-boundary.md
• uv run python -m unittest tests.test_postgres_store tests.test_generic_web_deploy tests.test_product_environment_read_model tests.test_service
• uv run python -m unittest tests.test_provider_target_audit tests.test_provider_target_backfill tests.test_product_environment_read_model tests.test_service
• uv run python -m unittest

Operational Notes

• No live target mutations are performed by this PR.
• After merge/deploy, Validate provider-target authority product-by-product #1105 should run product-by-product validation and a fresh Provider Target Operations audit before Retire provider-target compatibility aliases and projection fallback #1106 retirement.