feat(iac): scaffold orca-platform layout (M1.1)

Lands the per-VM × per-service manifest tree, per-env overlays, VM specs
for SysEleven provisioning, DNS zone placeholder, plan/apply/validate
scripts, and a Makefile.

Structure (per INFRASTRUCTURE.md §2 + IMPLEMENTATION_PLAN.md M1.1):
- manifests/{vm-edge,vm-control,vm-data,stage}/<service>.toml — 35 stubs
- overlays/{dev,stage,prod}/overlay.toml — env-selection rules
- vms/{vm-edge,vm-control,vm-data,stage}.toml — OpenStack flavor/IP/firewall
- dns/yourplatform.com.zone.template — PowerDNS zone (body lands in M0.3)
- cluster.toml.tmpl — cluster-level config rendered per env
- scripts/validate.sh — TOML parse + structural sanity
- scripts/plan.sh — merge manifests + overlay → .orca-out/<env>/
- scripts/apply.sh — push to Orca controller (no-op until M1.2)
- Makefile — validate / plan / apply / diff / clean

Each manifest header names the milestone that finalises its real values;
images today are 'placeholder' for services that need their own repo to
exist first. make validate stays green; apply gates on ORCA_API_URL.

CI workflow swapped from the broken 'orca validate' to 'make validate',
which calls a Python TOML parser plus structural checks (placement.node
matches vm dir, resources.memory present, no mis-nested keys).

Refs: M1.1

.gitea/workflows/ci.yaml

@@ -1,5 +1,6 @@
-# CI for orca-platform (IaC). `shared` always runs; `validate` activates
-# when at least one Orca manifest lands.
+# CI for orca-platform (IaC).
+# `shared` always runs (commitlint + gitleaks + trivy fs).
+# `validate` always runs (parses every manifest + overlay + vm spec).
 name: ci
 
 on:
@@ -53,18 +54,18 @@ jobs:
           TRIVY_VERSION=0.70.0
           curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \
             | tar -xz -C /tmp trivy
-          /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist .
+          /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist,.orca-out .
 
   validate:
     runs-on: docker
-    if: hashFiles('**/*.orca.yaml','**/*.orca.yml','manifests/**') != ''
     steps:
       - uses: actions/checkout@v4
 
-      - name: install orca
+      - name: setup python
+        shell: bash
         run: |
-          curl -fsSL https://orca.meghsakha.com/install.sh | sh
-          orca version
+          which python3
+          python3 --version
 
-      - name: orca validate
-        run: orca validate ./
+      - name: make validate
+        run: make validate