feat(pem): add authenticated direct-query gRPC endpoint

[entlein]

Exposes VizierService.ExecuteScript directly on the normal PEM over a dedicated port (:50305 default), so node-local clients can query Carnot without a broker hop or cloud dependency.

The feature is opt-in (--direct_query_enabled=false by default) so existing PEM deployments are byte-for-byte unchanged until opted in. A compile-time kill switch (--//src/vizier/services/agent/pem:direct_query=disabled) removes the feature entirely from the binary.

Changes:

direct_query_server.{h,cc} (new)

• DirectQueryServer implements api::vizierpb::VizierService::ExecuteScript against the live PEM Carnot (reusing its table_store + metadata callback).
• AuthenticateRequest: HS256 JWT verifier via BoringSSL HMAC + rapidjson. Requires aud=vizier, iss=PL, Scopes=service, valid exp. Defends against alg:none, wrong-key, expired, tampered-payload attacks.
• Fail-soft startup: init failure never brings the PEM data plane down.
• ExecuteScript only; mutations return UNIMPLEMENTED.

direct_query_server_test.cc (new)

• In-process gRPC fixture exercises the full auth metadata flow.
• Auth-negative cases: no token, wrong key, expired, alg:none, truncated, tampered header/payload/sig, wrong aud/iss/scope.
• Execution cases: trivial query, projection, time-range, join, concurrent.

BUILD.bazel (modified)

• config_setting(:direct_query_disabled) for compile-time kill switch.
• New deps on //src/carnot, @boringssl//:crypto, @rapidjson.
• New pl_cc_test(:direct_query_server_test).

pem_manager.{h,cc} (modified)

• MaybeStartDirectQueryServer() builds and starts the gRPC server after broker registration; StopImpl tears it down.
• Flags: --direct_query_enabled (default false), --direct_query_port (default 50305), --direct_query_jwt_signing_key.

shared/manager/manager.cc (modified)

• Empty-key guard at Manager::Init: refuses an empty PL_JWT_SIGNING_KEY rather than crashing mid-stream on the first service call.

DIRECT_QUERY_CONTRACT.md, DIRECT_QUERY_SECURITY.md (new)

• Behavioral spec, auth requirements, threat model, key-flow diagram, tampering test matrix, TLS transport details, disable instructions.