feat: cache resolved catalog access per Storage client

[konstantinoscs]

Summary

• Keep the catalog owner returned with vended credentials, so inherited and local resolutions stay distinct.
• Move credential caching into each StorageClient, with expiry-aware reuse and one vend for concurrent requests for the same catalog.
• Reject owner changes when renewing or escalating access that is already bound to a catalog, and validate returned mode and environment before caching.

Why

This establishes the resolved-access boundary needed by the next phase: a public load_catalog API can reuse one client safely, and the Tables SDK can later delegate read-to-write escalation without silently switching catalog ownership. Public exports and Tables integration remain out of scope for this PR.

Testing

• 69 focused Storage and Tables tests
• 243 full-suite tests passed, 10 skipped
• Black, Ruff, mypy, and diff checks
• Supported minimum and latest PyArrow compatibility checks

Stack

Depends on #359.

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: eac16a2f-ae5d-40e6-a791-fcc95af36c33

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}