control-plane: centralize spec-fetch authorization as Snapshot::spec_fetch_authorization (5/7)

[bbartman]

Description:

Part 5 of the snapshot-authorization stack (follows #3344). Decomposed from #3300, which this PR and its two successors replace.

Centralizes the policy for authorizing fetches of explicitly-named live specs as Snapshot::spec_fetch_authorization, so the enforcement points cannot drift:

• Staleness anchors on the fetching operation's durable queued instant (started_at) when the caller has one, and otherwise on the spec's own last publication time, which bounds the window in which grants could have been committed alongside the spec.
• An authoritative denial (snapshot postdates the anchor) drops or suppresses the spec — the pre-existing behavior. A provisional denial surfaces as the retryable AuthorizationSnapshotStale error instead of a silent omission.
• get_live_specs now routes through this shared policy.

The connected-spec expansion path (get_connected_live_specs) deliberately does not adopt the anchored policy: expansion widens validation with specs the caller never named, so a denial there remains a final omission with an unanchored check. The worst case of a not-yet-observed grant is only a narrower validation, while an anchored check would defer nearly every publication touching a connected spec its user can't edit. This is documented in a code comment at the call site.

Also in this PR:

• Per-module test Snapshot helpers consolidate into a shared #[cfg(test)] test_support module (used by live_specs and publications::specs tests).
• The dead ExpandedRow struct is removed from publications/db_complete.rs.

Verified locally: cargo nextest run -p control-plane-api -p agent — 292/292 passing at this branch tip.

Workflow steps:

No user-facing workflow change: authorization outcomes for named-spec fetches are unchanged except that a denial under a provably-stale snapshot is now retried rather than silently omitting the spec.

Documentation links affected:

None.

Notes for reviewers:

• Focus first on spec_fetch_authorization in crates/control-plane-api/src/server/snapshot.rs — the anchor-selection rule (started vs. last_pub_id.timestamp()) is the heart of the change.
• Then the two call-site treatments in crates/control-plane-api/src/live_specs/mod.rs: the named-fetch path adopts the policy; the expansion path intentionally diverges, with the rationale in the comment. Confirm you agree with the omission-vs-stale split.
• publications/specs.rs is mostly test migration onto the shared test_support helpers plus staleness-assertion coverage; test_support.rs is new test-only code.