feat(v0.6): implement W43 typed SCRAM administration

[ammarheidari]

Authority

W43 under #157 / tracker #146. Scope #145 is accepted and planning #147 is admitted. W41 is the prerequisite and is already admitted on protected main.

Current slice

• safe KafkaScramCredentialMetadata contains only exact user, mechanism and iterations;
• exact-user observation only; no all-user enumeration surface;
• typed IScramObservationPort;
• pinned Confluent.Kafka adapter calls DescribeUserScramCredentialsAsync with a bounded deadline;
• provider mapper admits only SCRAM-SHA-256 / SCRAM-SHA-512 and fails closed for unknown metadata shapes;
• compile/evidence tests directly bind the pinned IAdminClient describe and alter SCRAM symbols;
• architecture tests assert no byte[] / password / salt / secret / verifier field exists in the safe metadata contract.

Safety retained

No credential retrieval, no durable secret material, no SCRAM mutation adapter yet, no generic AdminClient/CLI/REST tunnel, no API/UI activation, no invented current-identity authority, and no claim that metadata can prove password equality.

Admission state

W43 ACTIVE / DRAFT / NOT MERGE READY.

The next slices must add domain-separated secret binding, one-shot original-requester finalization after independent approval, CRITICAL/current-authorization integration, typed provider alteration, ambiguity-safe verification and real Kafka lifecycle evidence. Any final admission must first reconcile latest admitted prerequisite main, including W42 if it merges meanwhile.

Refs #157 #146 #145