fix: scope configured IBKR sync to one inventory service

[Pigbibi]

Summary

• Add optional configured_service for target=configured, matching exactly one canonical admitted private-inventory service before cloud mutations.
• Scope plan, inventory, and legacy service sources together so deployment, env sync, traffic reconciliation, and Scheduler updates cannot expand back to other services.
• Skip global Scheduler migration cleanup and image/revision cleanup in single-service mode; preserve blank-input and hk-verify behavior.

Validation

• Regression first: 3 failures on original workflow.
• Focused workflow, reconciliation and admission tests: 21 passed.
• actionlint (shellcheck disabled), targeted ruff and git diff --check passed.
• Synthetic local tests only. No workflow dispatch, deployment, Scheduler/IAM/Gateway/broker operations or runtime activation.

Boundary

• Selection retains existing admission checks and existing deployment/env-sync enable flags; it grants no runtime authority.
• Do not merge or dispatch until supervisor confirmation.