feat: add Active Directory and GPO operations module

[Shpuntyara]

What changed

• Add identity-directory-operations for bounded Active Directory DS and Group Policy work.
• Route the Windows Server module to the new AD/GPO owner and retain Azure Entra ownership in cloud-azure.
• Add the dependency-closed identity-directory install profile, routing/ownership documentation, and catalog/manifest updates.
• Add resolver and installation regressions for the new capabilities.

Why

Windows host operations previously handed AD/GPO work to a future module. This PR replaces that gap with an explicit, fail-closed ownership boundary for directory provisioning and staged GPO changes.

Safety boundary

The module requires exact AD/GPO scope, immutable plan binding, approval, recovery evidence, a GPO backup, a canary, and effective-policy verification. Privileged groups, default policies, SYSVOL/DFS-R, broad delegation, and unbounded membership changes are blocked without an explicit high-risk plan.

Validation

• python -B devops-platform-contracts/scripts/validate_platform.py — 21/21 compatible skills
• python -B -m unittest discover -s tests -v — 33/33 passed
• quick_validate.py identity-directory-operations — passed
• Deterministic release build and verifier — passed