feat(app-control): add environments, integrated apps and multi-repo to the control-skill contract #9590

Slice A9b of #9507 (second half of poteto's A9 draft, comment).

Problem

Environments, integrated apps and multi-repo setups are not in the contract.

Fix

• ## Environments: consumer-named entries with url, dependency services, extends, write policy and production: true; production is read-only by default, attended production writes need a committed grant plus an in-session yes, unattended production writes are off. Per-tier Capture rows.
• ## Integrated apps: an integrated app gets its own control skill, included by reference; a missing other-repo checkout stops with the setting and the repository named.
• Drive's ready checks each dependency service. map create interviews for ownership across repositories.
• Two-process stdlib-Python fixture (an app that redirects to a stub identity server) under plugins/app-control/skills/map/evals/fixtures/identity/.
• Evals missing-other-checkout-stops-with-setting, integrated-app-composes, production-write-refused-by-default, unattended-production-write-off. Fragment: app-control minor.

Done when

• grep -E '^## (Steps files|Environments|Integrated apps)' plugins/app-control/reference/control-skill.md | wc -l prints 3.
• python3 -I plugins/app-control/skills/map/evals/fixtures/identity/serve.py --self-test exits 0.
• The four evals pass.

Blocked by: A9a.