Add authoritative Maestro activation validation

[haasonsaas]

Summary

• add a tenant-scoped Maestro activation validation route that compares every submitted field with the current authoritative resident, placement, lease, Pod UID, digest, service, and URI SAN tuple
• persist durable activation-ID CAS receipts with exact replay and different-material replay rejection across concurrent calls and API restarts
• expose bounded activation validation latency and outcome/reason telemetry without high-cardinality tuple labels
• keep resident observations, Pod/Service readiness, and listener probes outside activation authority; issue no identity material

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace

Needs a test

• SANDBOXWICH_TEST_POSTGRES_URL was not configured, so the new migration and PostgreSQL row-lock execution path were not exercised locally
• no live Maestro carrier, ClientAuth issuance, deployment, or activation sample was exercised