fix(trino): validate service authentication during pool readiness

[EDsCODE]

Summary

Trino pools with service authentication cannot certify coordinators because readiness treats every password authenticator as a replicated password file.

• Add a bearer-authenticated readiness callback that returns the token's configured cell identity without checking or minting tenant grants.
• Validate service authentication separately from file-password, group, and authorization revisions during admission and tenant publication.
• Bind the expected proof to each instance's immutable callback endpoint and stored pool ID.
• Keep incomplete candidates in PREPARING, allowing later probes to succeed before recording an admission receipt.

Before:

flowchart LR
  A[Service authenticator] --> B[File projection comparison] --> C[Admission rejected]
  classDef phBlue fill:#1d4aff,stroke:#1d4aff,color:#fff;
  classDef phYellow fill:#f9bd2b,stroke:#f9bd2b,color:#000;
  class A,B phBlue;
  class C phYellow;

Loading

After:

flowchart LR
  A[Authenticated callback proof] --> C[Admission and publication checks]
  B[File and policy revisions] --> C
  C --> D[Record complete receipt]
  classDef phBlue fill:#1d4aff,stroke:#1d4aff,color:#fff;
  classDef phYellow fill:#f9bd2b,stroke:#f9bd2b,color:#000;
  class A,B,C phBlue;
  class D phYellow;

Loading

Validation

• Local affected Trino lifecycle, callback, and publication tests passed through just test-trino.
• Local just lint, shell syntax, and Kubernetes lint for changed code passed. Full Kubernetes lint reports existing baseline findings.
• The disposable service-credential fixture now checks both authenticators on every serving coordinator. Cross-service execution remains unverified pending both companion builds.

Deployment

Deploy all Duckgres controllers before Trino #99. The callback proves endpoint reachability and pool-token acceptance; tenant-grant smoke tests remain necessary.

Existing VALIDATING receipts remain immutable and may need separate guarded recovery. This PR changes no UI.

🤖 Agent context

Codex (GPT-6) implemented and reviewed this change with delegated agents. Skills: writing-pr-descriptions and signed-git-publish. No production changes were made.

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	0	5	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +5 / -0
• Assertions: +17 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.