feat(security): serialize Brio database operations - #13

Closing this obsolete operational architecture proposal, rather than claiming it was merged. It adds the former cross-repository operation-lease/custom provider-policy system. Current protected main uses native GitHub CI on the existing Makepad runners, per-service deployment serialization, and the Brio release attestor with signed preflight/postflight runtime controls. The active system and its regression tests have passed real staging release acceptance. Reintroducing this old architecture is outside the current Brio maintenance rollout. The source branch is retained; this closure deletes no source, credentials, data or service. This is distinct from the older feature PRs verified as already incorporated.