chore: use fork of multicluster-runtime for coordinator fix

[scotwells]

Summary

Interim fix for #319: sigs.k8s.io/multicluster-runtime's Coordinator doesn't gate Manager.GetCluster or reconcile dispatch by cluster ownership, so a replica can act on a project's resources it was never granted ownership of by the sharded coordinator, even with a correctly-held fence Lease. This was reproduced directly against a real environment (real Milo control plane, real per-project storage isolation, 3 sharded replicas): with a project's fence Lease held by exactly one replica, all three replicas still reconciled the same object.

The fix belongs in the upstream library. We've implemented and validated it in a fork (datum-cloud/multicluster-runtime, branch fix/coordinator-ownership-gate): adds Coordinator.Owns(), gates Manager.GetCluster on it, and skips reconcile dispatch for non-owned clusters. Both mechanisms are enabled by default, so this is a pure dependency swap — no application code changes.

This PR points go.mod at that fork via a replace directive as an interim measure until the fix is proposed and accepted upstream, at which point this should be reverted in favor of a normal version bump.

Test plan

• go build ./... and go mod tidy succeed (verified locally)
• make test passes
• Re-run the sharded-coordinator repro from Sharded coordinator does not prevent multiple replicas from reconciling the same project #319 and confirm only the owning replica reconciles a project's resources