Evaluate effective runtime secret binding

[cbusillo]

Summary

• evaluate the effective runtime secret binding for a target when broader and narrower configured bindings both match
• keep fail-closed ambiguous_binding behavior for true duplicates at the same route specificity
• add unit coverage for context+instance coexistence and equally-specific duplicates

Motivation

After PR #1121 retired disabled placeholders, Odoo CM testing still failed live-target-runtime dry-run with ambiguous_binding:

• run: 26847996707
• trace: launchplane_req_beb763e5c10c48c7a2dc10ad2057b96c

Secret value resolution already allows context-level and instance-level records to coexist, with the more specific value winning. Runtime key-safety should evaluate the same effective binding instead of treating broader+narrower coexistence as ambiguous.

Validation

• uv run python -m unittest tests.test_runtime_key_safety tests.test_service.LaunchplaneServiceTests.test_live_target_runtime_api_dry_run_returns_redacted_delta tests.test_service.LaunchplaneServiceTests.test_live_target_runtime_api_requires_expected_managed_secret_values
• uv run --extra dev ruff check control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run --extra dev ruff format --check control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run --extra dev mypy control_plane tests