feat: add controlled SIT transfer fixture

[ramioooz]

Summary: add the disabled-by-default, namespace-guarded synthetic transfer seed and guarded local-SIT acceptance runner. It seeds matching customer, account, and immutable balanced opening Ledger records, references the existing PostgreSQL Secret without rendering values, and validates success, insufficient funds, compensation, and original Kafka terminal-event redelivery. Verification: Helm lint, SIT/non-SIT template matrix, bash -n, dry-run, and git diff check passed. Deploy/run only after the Ledger PR merges. Keep issue 261 open until runtime evidence and cleanup verification are complete.

[ramioooz]

Added the guarded and to this PR.

The runner now validates the approved fixture balances, successful debit/credit projection, insufficient-funds reservation behavior, Ledger-failure reservation release, and duplicate authoritative terminal-event delivery. It remains dry-run validated only; no SIT mutation has been executed. Cleanup restores temporary Auth/Ledger/Transaction changes and deletes the temporary Auth Secret.

[ramioooz]

Runner added: scripts/run-transfer-saga-acceptance.sh and docs/transfer-saga-acceptance.md. The runner validates fixture balances, successful debit-credit projection, insufficient-funds reservation behavior, Ledger-failure reservation release, and duplicate authoritative terminal-event delivery. It is dry-run validated only; no SIT mutation has been executed. Cleanup restores temporary Auth, Ledger, and Transaction changes and deletes the temporary Auth Secret.