feat: compile indexed Lattice auto-config roles

[mgazza]

Summary

Stacked on #4321.

• add immutable provider-local indexed/grouped PRIMARY and CONTROL role assertions
• compile deterministic contiguous target slots with explicit provider-local provenance
• allow multiple providers to assert the same slot only through explicit strong identity
  correlation
• reject conflicting slots, gaps, duplicate provider slots, and legacy/indexed mixing
• retain exact-one legacy singular targets as a compatibility surface
• expose explicit materialization readiness and keep every current plan fail-closed/shadow-only
  until capability projection bindings exist
• preserve ready-path retry, semantic-digest suppression, and invalidation feedback suppression

Safety

• no provider is registered
• no runtime or existing integration is changed
• no materializer callback can run from a plan produced by this tranche
• REFERENCE-only and incomplete indexed plans remain observable but not writable

Validation

• 38/38 focused auto-config tests
• 49/49 focused plus existing topology tests
• Black, Ruff F401, py_compile, CSpell, and diff checks
• GitNexus staged change detection: LOW, 2 files, 64 changed symbols, 0 affected execution flows

Tracks Predictive-Cloud-Ltd/predbat-saas-infra#561 and
Predictive-Cloud-Ltd/predbat-saas-infra#466.