Declare Odoo testing runtime expectations

[cbusillo]

Summary

• declare Odoo CM/OPW testing runtime-environment identity keys in seed onboarding material
• declare Odoo CM/OPW testing managed runtime secret bindings and expected config
• keep Odoo prod lanes undeclared until production secret ownership is validated explicitly
• make live-target-runtime fail closed when product-expected managed runtime secret values are missing from the resolved runtime payload

Agent review

Two review agents checked the branch. Feedback addressed before PR:

• hardened Odoo seed tests to assert exact testing env values and prod absence
• fixed live-target-runtime so expected managed secrets are required even when the value is missing from the resolved env map

Validation

• uv run --extra dev ruff check control_plane/live_target_runtime.py tests/test_service.py tests/test_product_onboarding.py
• uv run --extra dev ruff format --check control_plane/live_target_runtime.py tests/test_service.py tests/test_product_onboarding.py
• uv run --extra dev mypy control_plane tests
• markdownlint-cli2 docs/secrets.md
• jq empty import-material/launchplane/seed-imports/catalog.json
• uv run python -m unittest tests.test_product_onboarding tests.test_service.LaunchplaneServiceTests.test_live_target_runtime_api_dry_run_returns_redacted_delta tests.test_service.LaunchplaneServiceTests.test_live_target_runtime_api_requires_expected_managed_secret_values tests.test_service.LaunchplaneServiceTests.test_live_target_runtime_api_apply_updates_env_and_verifies tests.test_service.LaunchplaneServiceTests.test_live_target_runtime_apply_requires_database_for_key_safety tests.test_service.LaunchplaneServiceTests.test_live_target_runtime_api_maps_runtime_key_safety_database_error