feat(iac): scaffold orca-platform layout (M1.1)

Lands the per-VM × per-service manifest tree, per-env overlays, VM specs
for SysEleven provisioning, DNS zone placeholder, plan/apply/validate
scripts, and a Makefile.

Structure (per INFRASTRUCTURE.md §2 + IMPLEMENTATION_PLAN.md M1.1):
- manifests/{vm-edge,vm-control,vm-data,stage}/<service>.toml — 35 stubs
- overlays/{dev,stage,prod}/overlay.toml — env-selection rules
- vms/{vm-edge,vm-control,vm-data,stage}.toml — OpenStack flavor/IP/firewall
- dns/yourplatform.com.zone.template — PowerDNS zone (body lands in M0.3)
- cluster.toml.tmpl — cluster-level config rendered per env
- scripts/validate.sh — TOML parse + structural sanity
- scripts/plan.sh — merge manifests + overlay → .orca-out/<env>/
- scripts/apply.sh — push to Orca controller (no-op until M1.2)
- Makefile — validate / plan / apply / diff / clean

Each manifest header names the milestone that finalises its real values;
images today are 'placeholder' for services that need their own repo to
exist first. make validate stays green; apply gates on ORCA_API_URL.

CI workflow swapped from the broken 'orca validate' to 'make validate',
which calls a Python TOML parser plus structural checks (placement.node
matches vm dir, resources.memory present, no mis-nested keys).

Refs: M1.1

cluster.toml.tmpl

@@ -0,0 +1,29 @@
+# Cluster-level config rendered per env.
+# Real values get substituted by `make plan ENV=<env>` from environment +
+# overlays/<env>/overlay.toml.
+#
+# Schema mirrors ~/workspace/orca-infra/cluster.toml (Orca-native).
+
+[cluster]
+name = "breakpilot-${ENV}"
+domain = "${DOMAIN}"
+acme_email = "oncall@yourplatform.com"
+
+[ai]
+provider = "litellm"
+endpoint = "https://llm.yourplatform.com"
+model = "gpt-oss-120b"
+api_key = "${secrets.LITELLM_API_KEY}"
+
+[backup]
+enabled = true
+schedule = "0 0 3 * * *"
+retention_days = 30
+
+[[backup.targets]]
+type = "s3"
+endpoint = "https://s3.dus2.cloud.syseleven.net"
+bucket = "platform-${ENV}-backups"
+region = "dus2"
+access_key = "${secrets.S3_ACCESS_KEY}"
+secret_key = "${secrets.S3_SECRET_KEY}"