Fixed private authority recipe for safe-metadata cohort discovery.

The recipe captures exactly one immutable RunCatalogSnapshot, exposes the single analysis-catalog capability, and retains the private destination authorization used by the existing private analysis profile. Discovery does not admit a run and never opens a private payload.

analysis.catalog is deliberately profile-local rather than a selectable PtcRunner.Kernel.Library component. Its backing requirement exists only in this closed recipe; registering it as a general library would advertise an export that no workflow or manifest environment is allowed to satisfy.