Include global bindings in store-backed runtime safety

[cbusillo]

Summary

• fetch runtime secret binding candidates broadly in the store-backed key-safety helper
• let the shared evaluator choose exact, context, or global bindings by route rank
• cover global store-backed bindings with a regression test

Validation

• uv run --extra dev ruff check --exit-zero control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run python -m unittest tests.test_runtime_key_safety
• uv run --extra dev ruff check control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• uv run --extra dev mypy control_plane/runtime_key_safety.py tests/test_runtime_key_safety.py
• git diff --check