[major] Harden the modular cloud runtime foundation

[pennypacker-he]

Summary

• split provider entrypoints from the shared runtime contract and align Terraform, Ansible, and Salt package semantics
• harden Direct VPC egress, per-instance power IAM, host artifacts, rootfs verification, and privileged runtime boundaries
• add upgrade, provider, configuration-management, security, documentation, and cleanup contracts for the 1.0 transition

Verification

• make lint-check
• 35 GCP Terraform tests plus provider/module init and validate checks
• actionlint, ShellCheck, Terraform docs, GCP upgrade, and smoke-cleanup contracts
• hosted cloud smoke tests are required before merge

Merge gates

• update the pinned PPB image to the immutable v0.5 GAR digest after the dedicated publisher IAM is applied
• publish and pin the reviewed terraform-cloudrun-v2 Direct VPC revision
• configure protected cloud-smoke GitHub environments and move provider credentials out of repository scope
• merge only after every hosted check is green