ADR-24 CP2b: 6-step demo passes on cell-2 for copied user

Bounded surface audit complete. Feature flag copies_enabled gates
all ADR-24 code paths. 6-step demo flow verified end-to-end:
dashboard, group, project, issue (via work_items redirect), merge
requests, note creation.

Known limitations: copy-row materialization has deep schema
constraints (requires raw-SQL fixture workaround); cross-cell
routing missing (404 instead of redirect for wrong-cell resource).
See docs/sp2b-report.md for comprehensive risk register.

This is the final sub-project of the ADR-24 PoC program.