Add the Duo agent readiness card to project settings

What does this MR do and why?

Lays the foundation for DAP project readiness in Settings › General › GitLab Duo, per the Turn 4 design: a "Run GitLab Duo agents on this project" section containing a Required card, with the three enablement settings moved into it as rows.

Closes #607424

GitLab Duo, Allow flow execution and Allow foundational flows are not new settings — they already render on this page in the flat list.

Review round 2

Three changes since the first review, all in the second commit:

• The card no longer disappears when Duo is switched off. It was gated on can?(:duo_workflow, project), and that policy path bails out unless project.duo_features_enabled — the very setting the card's first row owns. Turning Duo off removed the card, leaving no way to turn it back on. It now gates on namespace/instance Agent Platform enablement, which does not depend on the project toggle. Thanks @julie_huang for catching it.
• STATUS_WAITING is now STATUS_BLOCKED. A row in that state is gated on a prerequisite rather than waiting on anything asynchronous.
• The duo_readiness_row spec is repaired: applying the suggestions from the web UI left shallowMountExtended unimported and two finders undefined.

Feature flag

Behind a new flag, duo_agent_readiness_settings (wip, user actor, default off) — tracked by #607567.

Test plan

• 461 frontend examples pass across the permissions components, including the 99 that already covered these toggles — the hidden inputs, cascading locks and disabled states are all still asserted.
• New duo_readiness_row spec covers the four status icons, the blocked/muted title, the nested indent, and the control / title-icon / description slots.
• Helper spec updated: current_user was an instance_double, which cannot act as a feature-flag actor, so it is now build_stubbed(:user).
• Verified over authenticated HTTP on GDK in both flag states: on renders the card, off renders the page exactly as master does.

Screenshots or screen recordings

Feature flag off — unchanged, identical to master

The three settings render in the flat list exactly where they do today, followed by tool approval, session tracking, audit events, the SAST settings and context exclusions.

Feature flag on — the Required card

The same three settings, now rows in the card: a status icon each, Allow foundational flows nested and tinted beneath Allow flow execution, and the "What are flows?" help link preserved inline.

The card ends here for now. Agent Platform, CI/CD runner and the agent configuration file are added on top in !247916, and the progress header follows once those rows exist.