datalake_agent: Hive Metastore catalog

[MisterRaindrop]

Part of #2008. Letters (A, B0–B7, C, D, E) are the PRs listed there; this is B6.

Scope

• HiveCatalog (iceberg-hive-metastore): thrift URI (hive_metastore_uri already accepted as a second spelling), HMS lock and commit semantics, pinned hive-metastore / hadoop-common.
• Kerberos through the UGI shim from the reference implementation: principal and keytab from server and user-mapping options, login once per credential fingerprint.
• HMS errors mapped through the B1 interceptor (NOT_FOUND, ALREADY_EXISTS, …).
• End-to-end against HMS plus MinIO in docker (the compose stack exists); Kerberos login path at unit level. No KDC in CI unless cheap.

Out of scope

Hive tables that are not Iceberg.

Depends on

B3.

Acceptance

• Conformance suite green against HMS; Spark and Cloudberry see each other's tables through the same HMS.
• Kerberos without a keytab fails at the first call naming the missing file.