Align service-plan upgrade sensitivity between preview and native Plan admission #183

The Application upgrade domain preview classifies service changes as sensitive, but the actual native Plan classifier treats an in-place service-plan update as ordinary. With both deployment policies direct and an edge requiring approval for sensitive changes, that native Plan currently does not require a sensitive approval receipt.

Reproduce offline with an update-only stackit_observability_instance Plan: classifyApplicationUpgradePlan() returns ordinary; SQL migration 080 admission requires sensitive approval only when the artifact classification is sensitive. The same mismatch may affect Secrets Manager plans and availability changes.

Align domain preview, Worker classification and database admission. Add a meaningful native Plan fixture plus database approval regression (no interrupted cloud Apply needed). Keep delete/replacement/unknown evidence hard blocks. Until fixed, the public upgrade guide explicitly states this limitation and requires users to inspect these changes in the Plan.