Bound privileged worker startup probe

[cbusillo]

Summary

• isolate the privileged-operation worker schema compatibility probe in a redacted child process
• enforce a 90-second wall-clock startup deadline so blocked client or network calls return to worker retry telemetry
• distinguish schema incompatibility, probe failure, and hard timeout without exposing database details
• limit the child environment to PostgreSQL, certificate, locale, and Python runtime inputs
• document the fail-closed startup boundary

Validation

• uv run --extra dev launchplane ci unittest-shard local (3,078 targets)
• uv run --extra dev mypy control_plane tests
• focused Ruff and format checks
• real PostgreSQL schema-probe/empty-poll and runtime statement-timeout integration tests
• production container build
• JetBrains production-file inspection: GREEN
• independent exact-head review: approved

Refs #2219