reshard: wait for rollback source convergence

[bill-ph]

Summary

• Gate every successful rollback metadata-store patch on Duckling reporting the recorded source, Ready=True, and a tenant-credential catalog probe.
• Reuse that convergence gate for cnpg→cnpg, external→cnpg, and cnpg→external adopt recovery; keep compaction paused when recovery cannot be verified.
• Add focused rollback regressions and document the blocked-recovery runbook.

Root cause

A reverse Duckling spec patch could be accepted while status and worker activation still referenced the failed target. The runner immediately marked the warehouse ready, admitting a connection into that unsafe ready-before-recovered window.

Validation

• Targeted Kubernetes-tagged rollback tests
• go test -count=1 -tags kubernetes ./controlplane/provisioner
• just lint

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	0	1	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +3 / -0
• Assertions: +13 / -0
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.