fix(proxima)!: remove inert MCP owner-access gate

[HeinrichvH]

Decision

Remove the inert OwnerAccessPort presence gate from the public Proxima runtime/facade builder.

Evidence

• MCP request handling consumes only Authenticator, whose AuthzContext is narrowed to the requested owner on every request.
• The shipped OIDC authenticator already receives and owns OwnerAccessPort.
• Custom authenticators previously had to register an otherwise-unused duplicate port.
• Regression tests cover custom-authenticator boot without separate owner-access registration; existing MCP/OIDC suites cover owner selection, unauthorized owners, session binding, and membership revocation.

Implements https://git.aquilo-cloud.com/AQS/aquilo/issues/5318 as the first v0.0.8 slice.

Alternatives rejected

• Rename the field to a marker: preserves a meaningless mandatory input.
• Thread the port into MCP serving: duplicates the authenticator trust boundary and risks divergent authorization state.

Green condition

A custom authenticator can serve MCP without a separate .owner_access(...) call, while missing authentication still fails closed and OIDC role resolution remains current per request.

Scope

No storage, wire, schema, migration, Lean-kernel, or dependency changes.

Verification

• cargo test -p proxima --lib
• cargo test -p proxima --test boot_pg --test flavor_workers_pg
• cargo test -p proxima-mcp --features code
• cargo clippy --workspace --all-targets
• cargo nextest run (1302 passed)
• cargo fmt --all -- --check
• python3 scripts/check-doc-links.py
• python3 scripts/check-doc-status.py
• python3 scripts/check-architecture-guardrails.py
• mkdocs build --strict
• git diff --check

Independent review: no critical, important, or minor findings.