Function run_production_system_plane 

pub async fn run_production_system_plane<F>(
    listener: TcpListener,
    router: Router,
    identity: Arc<SpiffeWorkloadIdentityProvider>,
    allowed_peer_spiffe_ids: impl IntoIterator<Item = String>,
    shutdown: F,
) -> Result<()>
where
    F: Future<Output = ()> + Send,

Serves a System Plane-only Router over rotating SPIFFE X.509-SVID mTLS. The verified peer SPIFFE ID is injected as the transport binding; request headers cannot manufacture or replace it.