feat(iac): scaffold orca-platform layout (M1.1)

Lands the per-VM × per-service manifest tree, per-env overlays, VM specs
for SysEleven provisioning, DNS zone placeholder, plan/apply/validate
scripts, and a Makefile.

Structure (per INFRASTRUCTURE.md §2 + IMPLEMENTATION_PLAN.md M1.1):
- manifests/{vm-edge,vm-control,vm-data,stage}/<service>.toml — 35 stubs
- overlays/{dev,stage,prod}/overlay.toml — env-selection rules
- vms/{vm-edge,vm-control,vm-data,stage}.toml — OpenStack flavor/IP/firewall
- dns/yourplatform.com.zone.template — PowerDNS zone (body lands in M0.3)
- cluster.toml.tmpl — cluster-level config rendered per env
- scripts/validate.sh — TOML parse + structural sanity
- scripts/plan.sh — merge manifests + overlay → .orca-out/<env>/
- scripts/apply.sh — push to Orca controller (no-op until M1.2)
- Makefile — validate / plan / apply / diff / clean

Each manifest header names the milestone that finalises its real values;
images today are 'placeholder' for services that need their own repo to
exist first. make validate stays green; apply gates on ORCA_API_URL.

CI workflow swapped from the broken 'orca validate' to 'make validate',
which calls a Python TOML parser plus structural checks (placement.node
matches vm dir, resources.memory present, no mis-nested keys).

Refs: M1.1

scripts/plan.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# `make plan ENV=<env>` — show what would be deployed for the given env.
+#
+# Merges manifests/ with overlays/<env>/overlay.toml and writes the resolved
+# service set to .orca-out/<env>/. Does NOT contact a cluster.
+#
+# Behavior in M1.1: the merge is a passthrough (overlays are placeholders).
+# A real merge that resolves per-env image tags and replica counts will land
+# alongside the first env-specific delta (M1.2 or later).
+
+set -euo pipefail
+
+ENV="${ENV:?usage: make plan ENV=<dev|stage|prod>}"
+case "$ENV" in dev|stage|prod) ;; *) echo "unknown env: $ENV" >&2; exit 2;; esac
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+OUT="$ROOT/.orca-out/$ENV"
+rm -rf "$OUT"
+mkdir -p "$OUT"
+
+OVERLAY="overlays/$ENV/overlay.toml"
+[ -f "$OVERLAY" ] || { echo "missing $OVERLAY" >&2; exit 1; }
+
+# Read include_dirs from overlay; fall back to all VMs (dev default).
+INCLUDE_DIRS=$(python3 - "$OVERLAY" <<'PY'
+import sys, tomllib
+data = tomllib.load(open(sys.argv[1], 'rb'))
+dirs = data.get('deploy', {}).get('include_dirs')
+if dirs is None:
+    dirs = ['manifests/vm-edge', 'manifests/vm-control', 'manifests/vm-data', 'manifests/stage']
+print('\n'.join(dirs))
+PY
+)
+
+echo "=== plan ENV=$ENV ==="
+echo "overlay:       $OVERLAY"
+echo "include_dirs:"
+echo "$INCLUDE_DIRS" | sed 's/^/  /'
+echo
+
+count=0
+while IFS= read -r dir; do
+  [ -d "$dir" ] || continue
+  for tml in "$dir"/*.toml; do
+    [ -e "$tml" ] || continue
+    rel="${tml#manifests/}"
+    dest="$OUT/$rel"
+    mkdir -p "$(dirname "$dest")"
+    cp "$tml" "$dest"
+    count=$((count+1))
+  done
+done <<< "$INCLUDE_DIRS"
+
+echo "→ wrote $count resolved manifests to .orca-out/$ENV/"
+echo "→ apply with: ORCA_API_URL=<url> make apply ENV=$ENV"