Add fail-closed behavior link switching

[woncon]

Summary

• Add a project-scoped API path to create a distinct behavior definition and atomically switch an explicit companion behavior links.
• Validate the complete expected link set, ownership, expected behavior IDs, and active jobs before switching.
• Reject stale or mixed link states and preserve the existing shared definition.
• Add synthetic PostgreSQL tests for target-only changes, idempotency, stale or incomplete targets, active jobs, rollback, and concurrent changes.

Validation

• tests/test_behavior_safe_switch.py -m live -q: 4 passed on the submitted code tree using a disposable PostgreSQL test database.
• Python compile check and git diff --check: passed.
• Base: b540e6b.

Limits

This does not enable a live cutover. New execution blocking, draining in-flight jobs, and cache invalidation across worker replicas are not established; the live switch remains fail-closed until those guarantees are implemented and verified. No production behavior links or STEP-06 status were changed.