Harden Airlock administration coverage

[Scriptception]

Summary

• replace whole-object group settings mutation with fail-closed, diff-only granular updates
• add cloud group inventory coverage and verify agent moves before saving state
• add generic contributor guidance, current coverage documentation, and stricter test/release gates

Safety

Unsupported group setting changes are rejected before any Airlock write. No tenant-specific data or environment details are included.