feat(lattice): add auto-config shadow telemetry

[mgazza]

Summary

• add a pure, immutable shadow comparator for compiled Lattice and detached legacy auto-config observations
• compare projected config, targets, routing, and provenance with deterministic JSON-pointer divergences
• emit bounded compiler/publication/provider/invalidation telemetry
• expose explicit default-closed hub, provider, capability, health, freshness, settlement, and materialization gates
• report requested-but-unobserved integration generations and bounded follow-up work
• keep all runtime registration, persistence, configuration writes, and control writes absent

Safety properties

• shadow input is recursively detached and neither legacy nor Lattice state is mutated
• comparison depth, node count, divergence count, paths, and summaries are bounded
• comparison-budget exhaustion is a fail-closed divergence
• provider or user-override invalidations block canary readiness until their requested generations are observed
• pending compiler follow-up work blocks readiness
• live run diagnostics take precedence over an immutable publication's prior status
• every rollout allowlist and activation switch defaults closed

Verification

• stacked Python 3.9 suite: 107 passed
• focused Python 3.14 suite: 35 passed
• Black, Ruff, cspell, and pre-commit checks passed
• GitNexus comparison: LOW risk, zero affected existing execution flows

Stacked on #4328. Tracks Predictive-Cloud-Ltd/predbat-saas-infra#554, #561, and #466.