Add the backfill census: changelog backfill inventory

[cotti]

Why

Backfill planning needs a full census before any selective run: config/products.yml cannot identify release-note surfaces on its own because the release-notes feature defaults to enabled, and only products with published history or native artifacts should produce backfill actions — while everything else must stay visible so an unresolved scope can never silently produce empty bundles.

Part of elastic/docs-eng-team#673 (sub-issue of the backfill epic elastic/docs-eng-team#656). Stacked on #3681 — the census writes the v1 inventory contract that PR introduces.

What

A new docs-builder changelog backfill inventory command (read-only apart from the local output file) backed by InventoryCensusService:

• Enumerates every release-notes product from products.yml and merges a hand-maintained census seed (YAML) mapping products to their release-note sources — repository, ref, paths, target scheme, cutoff, substitutions, attributed repositories, adoption state, and classification.
• Products the seed does not cover become source-unresolved entries with a warning; products can instead be deliberately deferred under unmapped, each with an auditable reason. source-unresolved is not seedable — it is the census's own conclusion, never an operator claim.
• Applies the epic's defaults: stack-versioned semver sources get the 9.0.0 cutoff when none is given; unresolved products get a target scheme derived from their versioning system (serverless/project → date, ech → monthly), always paired with a note so a guess never reads as confirmed fact.
• Checks attributed repositories against the local assembler.yml link allowlist (advisory — planning re-validates against the deployed scrubber allowlist identity, docs-eng-team#671 / Publish and resolve the deployed scrubber allowlist identity #3763).
• Output goes through BackfillDocuments: enveloped, schema-versioned, validated, content-addressed. Same inputs produce the same hash.

One contract adjustment to the parent PR's InventoryDocument: SourceRepository/GitRef are now null-able only for source-unresolved entries — the census records products whose location is unknown, which the previously required fields could not express. Validation still demands both for every other classification.

Verified end-to-end against the real repo config: 87 release-notes products enumerated; with a sample seed, the elasticsearch source got the stack default cutoff and elastic/cloud correctly reported off-allowlist.