feat(sending): expose retained key inventory for deployment guards

[jiashuoz]

Adds a bounded operator inventory so deployment tooling can reject unsafe key retirement and reuse of retired operator-recipient versions. -sending-protection-key-inventory emits one schema-1 JSON snapshot of stored policy identity, retained key requirements, and permanent recipient commitments, with no account/message identifiers, addresses, secret bytes, or audit actors.

Feedback and owner-notice HMAC references are separate from operator-recipient versions. Current authorized notice attempts keep their keys pinned beyond nominal expiry; superseded expired attempts do not. Corrupt policy, unresolved notice references, timeouts, and oversized inventories return a fixed error and no partial JSON. Normal startup migrations still precede the read-only command. Defaults, public HTTP/client APIs, and compiled sending contract level remain unchanged.

Validation:

• Focused Postgres inventory and CLI tests, including bounds, redaction, expiry, and delayed-feedback rotation; focused race run passed.
• Final built artifact exercised through real Docker CLI in two running servers: key addition and second-deploy selection passed; premature selection, retained-key removal, and recipient remapping rejected; both servers remained ready. Disposable resources removed.
• Independent and adversarial reviews passed after fixing the expired-current authorization finding. The regression failed before the fix and passed afterward.
• Full local suite passed the changed packages but failed in agent, e2e, identity, and relay (outreach counters and local timing/timeouts). Final CI passed 28 checks, with one expected release-only skip, including full Go, e2e, coverage, and cross-client checks.

Coordinated deployment integration: tokencanopy/e2a-ops#415. Inventory snapshots do not fence concurrent operator changes; deployments must serialize policy/secret administration. This PR does not activate policy or implement the subsequent compatibility-floor and billing recovery journal.