feat: borrow-transaction deploy/test/restore job in validate.yml

Part of the **Borrow, Prove, Restore** design (§5, D1, D4, D6, D9). Phase 2.

One credentialed job chained on `docker-push`, behind the existing ADR-036 trust gate, concurrency `spi-stack-` with `cancel-in-progress: false`:

gate (`spi status --json`: deployable ∧ ¬maintenance ∧ `requires` seeded ∧ declared dependencies unpinned — blocking, D9) → `spi service pin --image --ephemeral --run-id` → `spi service verify` → resolver bind → run acceptance image on the runner (D6) → `spi service reset --if-run` on `always()` → verdict (pass ⇔ borrow ∧ prove ∧ restore all green; attribution taxonomy: env-not-ready / infra / test-failure; zero-tests ≠ pass; interrupted ≠ pass).

- Neutral skip (reported pass with reason) when pointer variables absent — un-onboarded forks and unattached mirrors lose nothing.
- Required-check summary jobs (`🚀 Deploy to spi-stack`, `🧪 Acceptance Tests`) armed only after onboarding verification; per-run gate is live status, never a sticky boolean (D4).
- Repo surface stays five values: identity triplet + `SPI_STACK_RESOURCE_GROUP` + `SPI_STACK_CLUSTER` (§4, D2).

Depends on: Azure/osdu-spi-stack#129 (pin surface), Azure/osdu-spi-stack#130 (onboarding/identity), plus the descriptor/resolver and acceptance-image issues here.

Start with validate.yml and the existing ADR-036 trust gate, then read the linked pin-surface and onboarding/identity issues plus the referenced Borrow, Prove, Restore design sections. Trace the deploy, acceptance, reset, and required-check flow. Done means the credentialed job handles gating, neutral skips, verdict attribution, and cleanup as specified.

Written by the indexing model from the issue text.