feat(lattice): compose shadow runtime

[mgazza]

Summary

• compose the durable Lattice stores, provider registry, compiler, and whole-config target behind a default-off runtime gate
• keep the materializer forcibly disabled and leave the component unregistered, so this tranche cannot mutate live config, overlays, apps, or secrets
• add deterministic path preflight, sanitized bounded observations, strict provider identity validation, restart identity, and invalidation coalescing

Safety

This is a stacked PR on #4377. The default path returns before filesystem or source access. Even with the shadow gate enabled, no production caller is registered and the materializer remains disabled.

Verification

• focused runtime-composition tests: 13 passed on Python 3.9 and 3.14
• broader eight-module Lattice suite: 200 passed on Python 3.9 and 3.14
• exhaustive Unicode diagnostic normalization review
• GitNexus staged change detection: LOW risk, 136 symbols, 2 files, 0 affected processes

Tracks Predictive-Cloud-Ltd/predbat-saas-infra#466 and #561.