Allow global runtime secret bindings in safety routing

[cbusillo]

Summary

• rank global runtime secret bindings as valid low-specificity candidates
• preserve context and exact binding precedence over global candidates
• cover global shared-safe routing and context-over-global precedence in runtime key-safety tests

Validation

• uv run --extra dev ruff check --exit-zero control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run python -m unittest tests.test_runtime_key_safety
• uv run --extra dev ruff check control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run --extra dev mypy control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• git diff --check