AIT-72133: document baremetal Global-local auth for DR

[wgkingk]

Summary

• document the fresh-install Bare Metal Global DR split system-agent authorization model
• require explicit baremetal.cluster.io/system-agent-auth-scope for Global-local and shared workload plan classification
• add executable primary/standby AppRelease patches, direct-API handoff checks, and exact etcd-sync boundary verification
• verify Global-local identities stay cluster-local while the deferred shared workload bundle is synchronized atomically

Validation

• all 63 shell/bash blocks: bash -n
• yarn lint
• yarn build
• git diff --check

Related

• https://jira.alauda.cn/browse/AIT-72133

[cloudflare-workers-and-pages]

Deploying alauda-immutable-infra with    Cloudflare Pages

Latest commit:	d168c6e
Status:	✅  Deploy successful!
Preview URL:	https://32c634c5.alauda-immutable-infra.pages.dev
Branch Preview URL:	https://docs-baremetal-global-local.alauda-immutable-infra.pages.dev

View logs

[wgkingk]

Fresh-install live validation update:

• Bare Metal Primary/Standby Registry guidance now uses each side's own control-plane VIP on :11443; Registry no longer follows the platform-domain DNS switch.
• Added the public-registry-credential local-ignore requirement and removed the false assertion that baremetal-system-agent-handoff must appear in ignore-equal.txt (that ConfigMap is outside all configured sync ranges).
• Updated tested etcd-sync provenance to 86c2ce5 / v4.3.16-hotfix.179.5.g86c2ce50-t.
• Standby live result: ModuleInfo Running, AppRelease Success, both Deployments Ready, filter audit passed, monitor missed/surplus 0/0, target counts 555/555, and the .249 Registry value remained local after synchronization.
• Branch rebased onto current master; yarn lint and both PR checks passed.