Dedupe catalog group and user definitions to a single source #114

Part of #85

The catalog defines the same entities twice. default-catalog/groups.yaml defines group:default/readers, group:default/developers and group:default/admins, and examples/groups/readers.yaml, developers.yaml and admins.yaml define the same three refs. default-catalog/users.yaml defines user:default/guest (plus development and production namespace variants) and examples/users/guest.yaml defines user:default/guest again. When both locations load, the catalog reports conflicting entityRefs for all of them. Noted during the #113 run.

Scope for this slice:

• Keep examples/ as the single source for readers, developers, admins and guest, as documented in docs/demo-baseline.md
• Remove the duplicate Group definitions from default-catalog/groups.yaml and the duplicate guest User definitions from default-catalog/users.yaml, keeping the unique johnnyhuy user and the echohello organisation group
• Update default-catalog/catalog-info.yaml targets to match
• Verify the backend catalog processes with no conflicting entityRef warnings

Out of scope: permission policy changes, new users or groups, demo data redesign.

Parent epic #85 stays open. This child closes when the PR merges.