Starts a budgeted walk over every discovered (tenant, plane) chain and returns
immediately with a run to poll.

It is asynchronous because the alternative is an outage. A synchronous
platform-wide walk is a scan of every partition of an unbounded WORM table held
open by an HTTP request.

It is single-flight. A request made while a platform run is already walking
joins that run and returns its identifier rather than starting a second one, so
the endpoint cannot be used as a load-generation primitive by anyone holding the
scope.

Progress is readable at GET /platform/integrity/runs/{runId}, whose row
counter advances monotonically — a stalled run reads as a frozen counter rather
than as silence.