feat(auth): enforce protected routing and fail-safe invalidation - #4789

Why

Every protected route needs a complete route inventory and durable invalidation state so no transport can continue authorizing after its authority becomes stale or unavailable.

What

• Enforce protected-route classification at the shared router boundary
• Persist monotonic invalidation floors, idempotent operation receipts, and authority epochs
• Propagate invalidation across relay instances and enter a deny-protected mode when authority cannot be trusted
• Apply server-owned enrollment and typed provider-installation provenance
• Add the invalidation and authority migration sequence from 0040 through 0042
• Reuse the same visibility fence across protected Git and related storage paths

Review guide

• Route inventory and default-deny handling for unclassified protected requests
• Invalidation storage, authority epochs, operation receipts, and database triggers
• Cross-relay publication and subscription behavior, restoration, and deny-protected mode
• Relay, workflow, and storage consumers of the shared invalidation fence

Risk assessment

Medium. This PR changes protected routing and invalidation across relay instances. Protected requests deny when routing or invalidation authority is absent, ambiguous, or stale, and the behavior remains off by default.

Testing

• Protected-route inventory and method-classification cases
• Invalidation ordering, replay, duplicate, restoration, and cross-relay cases
• Fresh and incremental migration coverage through 0042
• Trigger, visibility, workflow, formatting, linting, and hosted repository checks

References

• Depends on feat(auth): harden trusted evidence and protected objects #4783
• Runtime status and session integration: feat(auth): install runtime status and session conformance #4790