feat(trino): allow tenant DuckLake writes

[EDsCODE]

Summary

• allow DuckLake schema, table, view, and DML operations only in catalogs owned by the requesting tenant
• require both rename source and destination catalogs to be tenant-owned
• keep the provisioner admin, unmanaged catalogs, cross-tenant targets, permission management, materialized views, functions, and catalog session properties denied
• bump the embedded OPA bundle revision so policy activation is visible during rollout

This unlocks the write path delivered by PostHog/trino#2 without widening the shared-cell tenant-isolation boundary.

Security model

A new writable_catalog predicate requires all three conditions:

1. the requester is not the provisioner admin
2. a non-admin identity group owns the catalog in the provisioned bundle
3. the catalog matches the managed org_* naming convention

Adversarial tests cover other tenants, unmanaged catalogs, unknown identities, the admin identity, an admin carrying an accidental tenant-group claim, missing rename targets, and cross-catalog rename attempts.

Validation

• go test ./controlplane/provisioner/opa -count=1
• go test ./controlplane/provisioner/... -count=1
• git diff --check
• just lint was attempted but could not complete locally because unrelated untracked integration tests outside this diff do not type-check on current main; the affected packages compile and pass above

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	0	1	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +3 / -0
• Assertions: +17 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.