Atomic cutover: retire the provisional drm/rights/key/decrypt surface (ELACITY-2299) #46

From the 0.7 completion checklist in #38 (unfinished at merge time).

Remove the provisional drm/rights/key/decrypt capsule surface in one step: no parallel decoders and no compatibility path. The provisional capsules remain the registered product path until this cutover; the retirement guard (scripts/protected-content-provider-contract-smoke.sh) protects the boundary and stays green until the switch.

Tracked as ELACITY-2299. Depends on #44 (installed prerequisites) and #45 (proofs). Blocks #47. One atomic cutover.

Implementation: PR #203 (supersedes the older PR). Merge needs #44 (installed prerequisites) and #45 (proofs) accepted first.