Draft: Add the set_setting write-back executor

What does this MR do and why?

Adds Govern::PolicyEngine::ConvergeProjectSettingExecutor, the executor behind the set_setting action. When an enforce-mode policy reports a violated setting, the executor writes the expected value through Projects::UpdateService and then re-reads the stored value, because a write can report success while a cascade coerces the value.

The action catalog runs it in enforce mode only. Which triggers may carry set_setting is the policy store's save-time check, so dispatch makes no second ruling. A setting that two enforce policies disagree on never gets a write. The executor reports converge_conflict instead of letting the value oscillate between evaluations. The write target comes from the policy's own setting_validation rule, read at write time, so a policy edited after the evaluation still decides.

The code comes from the prototype in !259574, now with specs. No changelog entry, because security_policies_v2 defaults to off.

The executor reads the conflicted settings the conflict check reports, so this MR waits on it.

Merge plan (nested = depends on parent, siblings = parallel)

• !261560 (merged) evaluation service
  • !261838 settings fence
  • !261561 drift workers
  • !261562 conflict check
    • !261837 set_setting write-back (this MR)
      • !264545 cross-trigger E2E (also needs fence, drift workers)
• !262405 effective archived state

References

• Issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/630155
• Epic: https://gitlab.com/groups/gitlab-org/-/work_items/23462

Screenshots or screen recordings

Backend-only change, no UI.

Before	After

How to set up and validate locally

1. Create an enforce-mode settings policy with a setting_validation rule and a set_setting action.
2. Change the governed setting away from the expected value, then run Govern::PolicyEngine::ScheduleWorker.new.perform in the Rails console.
3. The stored value returns to the expected one, and the enforcement row reports completed.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.