fix(identity): project gateway tick heartbeats into PlatformDirectory

Parent: #384 (P0-2d). Depends on P0-2a and P0-2b.

## Scope
Make successful scoped gateway tick/heartbeat update the PlatformDirectory runtime heartbeat projection.

## Acceptance
- Successful scoped heartbeat updates last_heartbeat_at for the bound Directory identity.
- Failed/unauthorized heartbeat does not update Directory.
- Repo lease and Directory heartbeat timestamps are observably correlated.
- Tests cover success, denial, and Directory unavailability fail-closed.

Delivery discipline: one issue, one worker branch, one PR.

Start by tracing the successful scoped gateway tick/heartbeat into the bound PlatformDirectory identity, including the dependency work in P0-2a and P0-2b. Add tests for successful projection, denied heartbeats, and Directory unavailability; done means correlated lease and Directory timestamps with unauthorized or unavailable cases failing closed.

Written by the indexing model from the issue text.