feat(iac): scaffold orca-platform layout (M1.1)

Lands the per-VM × per-service manifest tree, per-env overlays, VM specs
for SysEleven provisioning, DNS zone placeholder, plan/apply/validate
scripts, and a Makefile.

Structure (per INFRASTRUCTURE.md §2 + IMPLEMENTATION_PLAN.md M1.1):
- manifests/{vm-edge,vm-control,vm-data,stage}/<service>.toml — 35 stubs
- overlays/{dev,stage,prod}/overlay.toml — env-selection rules
- vms/{vm-edge,vm-control,vm-data,stage}.toml — OpenStack flavor/IP/firewall
- dns/yourplatform.com.zone.template — PowerDNS zone (body lands in M0.3)
- cluster.toml.tmpl — cluster-level config rendered per env
- scripts/validate.sh — TOML parse + structural sanity
- scripts/plan.sh — merge manifests + overlay → .orca-out/<env>/
- scripts/apply.sh — push to Orca controller (no-op until M1.2)
- Makefile — validate / plan / apply / diff / clean

Each manifest header names the milestone that finalises its real values;
images today are 'placeholder' for services that need their own repo to
exist first. make validate stays green; apply gates on ORCA_API_URL.

CI workflow swapped from the broken 'orca validate' to 'make validate',
which calls a Python TOML parser plus structural checks (placement.node
matches vm dir, resources.memory present, no mis-nested keys).

Refs: M1.1

scripts/apply.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# `make apply ENV=<env>` — push the resolved manifest set to an Orca controller.
+#
+# Refuses to run unless ORCA_API_URL is set (or read from overlays/<env>).
+# In M1.1 this is a guard; the real call lands once vm-edge has an Orca
+# controller (M1.2).
+
+set -euo pipefail
+
+ENV="${ENV:?usage: make apply ENV=<dev|stage|prod>}"
+case "$ENV" in dev|stage|prod) ;; *) echo "unknown env: $ENV" >&2; exit 2;; esac
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+OUT="$ROOT/.orca-out/$ENV"
+
+if [ ! -d "$OUT" ]; then
+  echo "no resolved manifests at $OUT — run \`make plan ENV=$ENV\` first" >&2
+  exit 1
+fi
+
+if [ -z "${ORCA_API_URL:-}" ]; then
+  echo "ORCA_API_URL not set." >&2
+  echo "M1.2 will provision the controller; until then \`make apply\` is a no-op." >&2
+  echo "Want to dry-run? Use \`make plan ENV=$ENV\` and inspect .orca-out/$ENV/." >&2
+  exit 0  # exit 0 — no-op is the expected M1.1 behaviour
+fi
+
+# Real apply once a controller exists. orca CLI deploys a directory of TOMLs.
+echo "=== apply ENV=$ENV against $ORCA_API_URL ==="
+orca --api "$ORCA_API_URL" deploy --file "$OUT"