Add DB-backed privileged worker heartbeat proof

[cbusillo]

Summary

• persist a bounded DB-backed successful-poll heartbeat for the supervised privileged-operation worker
• bind proof to Dokploy's selected Docker container through validated container-ID/hostname identity plus exact immutable image equality
• make runtime logs diagnostic-only while preserving fail-closed provider state, image, freshness, and identity checks
• add Alembic migration, PostgreSQL/storage/HTTP/workflow tests, operational docs, and rollback guidance

Milestone alignment

Closes #2219. This is the worker-proof prerequisite for #2204 in the Authorization Root-of-Trust Evidence milestone. It adds no authorization action, grant, canary activation, secret mutation, or live target mutation.

Validation

• uv run --extra dev launchplane ci unittest-shard local — 3,081 targets, 12/12 shards
• uv run --extra dev mypy control_plane tests — 761 files
• changed-file Ruff check and format check
• real PostgreSQL integration gate — 91 tests; final focused migration/heartbeat checks at revision d2219a0b1c2d
• production Docker image build
• real image + entrypoint + disposable PostgreSQL smoke: Docker hostname prefix validated; heartbeat identity and immutable image matched
• Opus final review: approved after findings resolved
• Gemini final review: approved
• JetBrains inspection: UNKNOWN after built-in retry because results remained stale; no changed-file finding was produced