Allow Odoo prod runtime secret bindings

[cbusillo]

Summary

• classify the Odoo runtime secret bindings as shared-safe for the stable CM/OPW lanes
• allow those bindings for both testing and prod instances in the runtime key-safety seed
• add seed catalog assertions so the policy keeps matching the prod runtime contract

Validation

• uv run python scripts/deploy/apply-launchplane-seed-imports.py --catalog import-material/launchplane/seed-imports/catalog.json --output-dir /tmp/launchplane-seed-policy-dryrun --kind runtime_key_safety_policy --import-id launchplane-runtime-key-safety-policy
• uv run python -m unittest tests.test_product_onboarding
• uv run --extra dev ruff check --exit-zero tests/test_product_onboarding.py
• uv run --extra dev ruff check tests/test_product_onboarding.py
• uv run --extra dev mypy tests/test_product_onboarding.py
• git diff --check