[konstantinoscs]

Summary

• Freeze the existing tower.tables() routing contract before Phase 1 refactors it.
• Preserve native PyIceberg configuration for S3 Tables and BYO catalogs, including write operations.
• Preserve explicit pyiceberg.catalog.Catalog objects and the tower_credentials=True/False overrides.
• Require an authoritatively managed Tower catalog to fail closed when credential vending fails; it never falls back to similarly named ambient credentials.

This PR intentionally changes no production code. It is the regression-contract base for the rest of Stack A.

Compatibility contract

• Explicit catalog object → use that object; do not inspect Tower or ambient string configuration.
• Known tower-catalog → Tower credential vending.
• Known S3 Tables or BYO catalog → existing pyiceberg.load_catalog(name) configuration.
• No Tower auth plus runner-injected PYICEBERG_CATALOG__* config → ambient PyIceberg only.

Verification

• Focused routing suite: 17 tests passed.
• Full Stack A suite from the top: 225 passed, 10 skipped.

Stack

1 of 5 in Stack A. Review this first; the next PR is #340.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f0dad72c-4fc0-40d4-a700-837650f26c72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}