Add deterministic tenant dependency normalization

[cbusillo]

Tenant Dependency Normalization

Summary

• add platform dependencies normalize for canonical tenant uv.lock regeneration
• normalize inside the existing staged tenant/shared-addon dependency workspace
• pin resolution and strict checks to the manifest Python version without broad
  upgrade flags
• verify the tenant-CI frozen export shape, emit secret-free provenance, and
  roll back atomically on failure
• document the mutating command separately from read-only quality gates

Validation

• uv sync --locked
• uv run python -m unittest discover -s tests — 245 passed, 1 skipped
• uv run ruff format --check .
• uv run ruff check .
• uv lock --check --offline --no-config --project docker/runtime-python
• uv build
• live nested-workspace normalization test proves repeated runs are byte-idempotent
• JetBrains explicit-file inspection completed; all reported warnings are
  pre-existing/outside the PR diff, with no finding on added lines
• independent Opus review: APPROVE at exact head
  9f0ea308da23fe7ec77e214dc335766c0a72ef88
• independent Gemini review: APPROVE at exact head
  9f0ea308da23fe7ec77e214dc335766c0a72ef88

Closes #97
Refs cbusillo/launchplane#1935

This PR intentionally does not begin cbusillo/odoo-tenant-opw#113.