Add merge train controller run-once endpoint

[cbusillo]

Summary

• Add POST /v1/work-graph/merge-train/controller/run-once as the one-action controller for full batch merge-train progression.
• Let the controller advance one safe phase per call across stack collapse, collapsed-root admission, candidate plan/build/observe, landing plan, landing, and stack child disposition.
• Reuse DB-backed merge-train records and policy-backed auth/token resolution; reject stale policy digests before advancing stored candidate or landing records.
• Document the controller as the preferred operator entrypoint.

Verification

• uv run --extra dev ruff format --check control_plane/service.py tests/test_service.py
• uv run --extra dev ruff check control_plane/service.py tests/test_service.py
• uv run --extra dev mypy control_plane/service.py tests/test_service.py
• uv run python -m unittest tests.test_service.LaunchplaneServiceTests.test_merge_train_controller_advances_unstacked_batch_flow tests.test_service.LaunchplaneServiceTests.test_merge_train_controller_advances_stacked_batch_flow tests.test_service.LaunchplaneServiceTests.test_merge_train_controller_rejects_candidate_after_policy_digest_changes
• uv run python -m unittest tests.test_service.LaunchplaneServiceTests tests.test_merge_train_stack_collapse tests.test_merge_train_worker tests.test_merge_train
• uv run python -m unittest

Inspection

• Targeted PyCharm inspection completed for control_plane/service.py and tests/test_service.py; it reported existing broad warnings in the large files, not a new blocking error in the controller path.