P2: load a verified ASTER resolver in the packaged DRIFT runtime

[tuzuminami]

Problem

The packaged DRIFT executable has no configuration path for an artifactResolver. ASTER-reference scenarios therefore cannot be resolved by the standard production runtime even after external auth is configured.

Acceptance Criteria

• Define a separate, documented resolver module loader and trust boundary.
• Perform tenant-scoped ASTER lookup, strict v2 bundle parsing, bounded timeout, and stable 404/409/503 mapping.
• Add packaged-server E2E from ASTER v2 bundle retrieval through scenario publish.
• State resolver readiness/degraded behavior in /readyz and runbooks.