fix(realm): remove runtime application RPs from the portable import

[seonghobae]

Buyer-visible gap

The architecture and desired-state API now define application relying parties as runtime deployment data, but deploy/keycloak/realm-cwl.json still commits ecosystem-rp-template and naruon-web. A clean realm rebuild can therefore recreate deleted or changed tenant-specific clients outside the Keyverse reconciliation boundary, and the realm validator currently requires that contradictory state.

Required change

After #70 provides the closed runtime audience/session-claim mapper profile:

• remove ecosystem-rp-template and naruon-web from the portable realm JSON;
• retain the internal account-unification-svc service-account client required to operate the control plane;
• change scripts/validate_realm.py so committed application RPs are rejected rather than required;
• preserve the basic, profile, and email portable client scopes;
• add a clean-realm recovery test that preflights and reconciles the Naruon runtime template through Keyverse;
• document startup ordering: service-account bootstrap, RP desired-state reconciliation, confidential secret placement where applicable, then controlled login acceptance;
• remove stale documentation and tests that say Naruon is embedded in the realm;
• update CHANGELOG.md, architecture, operations, and APA 7th doctoring.

Completion evidence

Require exact-current-head full CI, production docstrings/statement/branch coverage 100%, realm import validation, Compose/template validation, CodeQL, Semgrep, Security Scan, independent review, zero unresolved threads, and protected merge. No administrator bypass or release is included.

Depends on #70.
Tracks #2.