feat(iac): scaffold orca-platform layout (M1.1)

Lands manifests/, overlays/, dns/, scripts/, Makefile per M1.1. Bundles yourplatform.com→breakpilot.com rename. vms/ removed (out-of-scope for Orca).

Refs: M1.1

overlays/README.md

@@ -0,0 +1,9 @@
+# Overlays
+
+Per-env *sparse* deltas applied on top of `manifests/`. Concept: each overlay
+file may set just the fields that differ from the base manifest. The merge
+script in `scripts/plan.sh` produces the final per-env service set at
+`.orca-out/<env>/`.
+
+For now the overlays are placeholder structures — concrete deltas land with
+the milestones that introduce real images and replica counts (M4.1, M5.1, M6.x).

overlays/dev/overlay.toml

@@ -0,0 +1,11 @@
+# Dev overlay — placeholder.
+#
+# Dev runs everything in docker-compose on the developer's laptop, not via
+# Orca. This overlay exists so `make plan ENV=dev` is symmetric with stage/
+# prod, but it does not yet point at real images.
+#
+# Real dev wiring lives in the per-service repos' `make dev` target.
+
+[env]
+name = "dev"
+api_url = ""  # no orca controller; apply is a no-op

overlays/prod/overlay.toml

@@ -0,0 +1,15 @@
+# Prod overlay.
+#
+# Selects manifests under vm-edge / vm-control / vm-data. Stage manifests
+# (manifests/stage/) are excluded from prod apply.
+
+[env]
+name = "prod"
+api_url = "${ORCA_PROD_API_URL}"
+
+[deploy]
+include_dirs = ["manifests/vm-edge", "manifests/vm-control", "manifests/vm-data"]
+
+[image]
+# Default tag for prod; release.yaml retags `env-stage` → `v$VERSION` + `env-prod`.
+default_tag = "env-prod"

overlays/stage/overlay.toml

@@ -0,0 +1,16 @@
+# Stage overlay.
+#
+# Stage maps to the single 'stage' VM, app plane only. Selects only the
+# services under manifests/stage/.
+
+[env]
+name = "stage"
+api_url = "${ORCA_STAGE_API_URL}"
+
+# Service filter: only deploy manifests under this directory.
+[deploy]
+include_dirs = ["manifests/stage"]
+
+[image]
+# Default image tag for stage builds. Per-service overrides may land later.
+default_tag = "env-stage"