Define product-owned action-scoped environment inventories

## Outcome

Governed one-shot actions receive only the environment keys they need, using product-owned versioned inventories rather than lane-wide environment files or Registryctl-maintained copies of product configuration schemas.

This is post-1.0 hardening. The 1.0 contract remains intentionally small: preview and exact verify receive no environment or secrets; accept receives the signed lane environment only for the existing product-owned audit configuration, with no serving file secrets or network access.

## Design constraints

- Product crates own the meaning and validation of their environment keys.
- Registryctl and the release lock must not duplicate dynamic product schemas.
- The contract remains closed and versioned. It is not an arbitrary environment-projection language.
- Source, OAuth, ingestion, serving, signing, and cross-lane credentials remain unavailable to state-only actions.
- Secret values stay in operator-owned material and never enter generated configuration or diagnostics.

## Definition of Done

- [ ] Relay and Notary publish machine-readable, versioned action-to-environment inventories from product-owned definitions.
- [ ] The signed release contract binds the exact inventories used by generated deployments.
- [ ] Generated one-shot services project only the declared keys for their action.
- [ ] Missing, extra, cross-lane, source, OAuth, ingestion, and serving capabilities fail closed in tests.
- [ ] Audit-before-mutation and existing product semantic validation remain intact.
- [ ] Clean-context deployment tests cover initialisation, preview, accept, exact verify, and rotation without exposing values.

## Non-goals

- A generic secret manager integration.
- Arbitrary per-service environment editing.
- Replacing product-owned configuration validation.

Inizia individuando le definizioni degli ambienti di proprietà del prodotto di Relay e Notary, il contratto di release firmato, i servizi one-shot generati e i test di deployment in un contesto pulito. Traccia il modo in cui gli inventari vengono pubblicati e associati, quindi verifica che la proiezione specifica dell'azione, la validazione fail-closed, l'ordine dell'audit e la diagnostica priva di valori coprano l'inizializzazione, l'anteprima, l'accettazione, la verifica esatta e la rotazione.

Scritto dal modello di indicizzazione a partire dal testo della issue.