fix(iac): drop vms/ — Orca does not provision VMs

Re-read the Orca spec: 'orca nodes' lists already-joined hosts and
'orca join' attaches an existing node to a cluster, but Orca does not
provision the VMs themselves. VM provisioning (SysEleven OpenStack
via Terraform) is a separate concern and will land in a dedicated repo
under the M1.2 milestone, not in orca-platform.

Removes vms/{vm-edge,vm-control,vm-data,stage}.toml + vms/README.md.
Updates README directory tree and milestone fill-in table to reflect
that M1.2's VM specs live elsewhere. validate.sh stops checking vms/.

Refs: M1.1

README.md

@@ -29,11 +29,6 @@ The single source of truth for which container runs on which VM in which environ
 │   ├── dev/overlay.toml        no-op; dev runs docker-compose per-service
 │   ├── stage/overlay.toml      include manifests/stage/, image_tag=env-stage
 │   └── prod/overlay.toml       include vm-{edge,control,data}, image_tag=env-prod
-├── vms/                        # OpenStack VM specs (consumed by M1.2 provisioner)
-│   ├── vm-edge.toml            m2.small, public IP, identity+infra
-│   ├── vm-control.toml         m2.medium, private, control plane
-│   ├── vm-data.toml            m2.medium, private, data plane (scale driver)
-│   └── stage.toml              m2.small, public IP, ephemeral
 ├── dns/
 │   └── breakpilot.com.zone.template   PowerDNS zone — body lands in M0.3
 ├── cluster.toml.tmpl           # Cluster-level config (acme_email, backup, ai); rendered per env
@@ -63,7 +58,7 @@ Each stub manifest in `manifests/` carries a header comment naming the milestone
 | Milestone | What it fills in                                                |
 |---|---|
 | **M0.3**  | `vm-edge/powerdns-auth.toml`, DNS zone body, orca-proxy routes  |
-| **M1.2**  | VM provisioning (consumes `vms/*.toml`); brings `make apply` online |
+| **M1.2**  | VM provisioning (Terraform/OpenStack in a separate repo); brings `make apply` online |
 | **M1.3**  | Backup cron services + `scripts/restore-drill.sh`               |
 | **M2.1**  | `vm-edge/keycloak.toml` + `pg-keycloak.toml`                    |
 | **M3.1**  | `vm-edge/infisical.toml` + `pg-infisical.toml` + `redis-infisical.toml` |