DEN-20: declare ores-locks-and-leases runtime boundary

[ORESoftware]

Begins the mutation-path adoption required by declmig-lib-core#20 without performing an unsafe advisory-key flag day.

• declares oresoftware/ores-locks-and-leases = "=0.1.1" in DPM's Zed package manifest;
• documents ores-locks-and-leases as the sole public fleet coordination abstraction and direct provider imports as forbidden;
• specifies a compatibility-safe dual-lock rollout because the existing PostgresMigrationLease uses a legacy numeric advisory key;
• requires contention, lease-expiry/renewal, fencing/stale-runner, crash/restart, cleanup, PostgreSQL restart/network-reset, and separate Cockroach qualification before the legacy lock is retired.

This PR deliberately does not claim the runtime conversion is complete. .zpkg.lock must be produced by the canonical Zed resolver, and the Rust execution path must then consume the shared package with exact-head test-org evidence. Changing the advisory key without a dual-lock window would allow old and new DPM binaries to migrate the same database concurrently.

Refs declarative-migrations/declmig-lib-core#20
Refs #16

[linear-code]

DEN-20