feat(iac): scaffold orca-platform layout (M1.1)

Lands manifests/, overlays/, dns/, scripts/, Makefile per M1.1. Bundles yourplatform.com→breakpilot.com rename. vms/ removed (out-of-scope for Orca).

Refs: M1.1

scripts/apply.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# `make apply ENV=<env>` — push the resolved manifest set to an Orca controller.
+#
+# Refuses to run unless ORCA_API_URL is set (or read from overlays/<env>).
+# In M1.1 this is a guard; the real call lands once vm-edge has an Orca
+# controller (M1.2).
+
+set -euo pipefail
+
+ENV="${ENV:?usage: make apply ENV=<dev|stage|prod>}"
+case "$ENV" in dev|stage|prod) ;; *) echo "unknown env: $ENV" >&2; exit 2;; esac
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$ROOT"
+OUT="$ROOT/.orca-out/$ENV"
+
+if [ ! -d "$OUT" ]; then
+  echo "no resolved manifests at $OUT — run \`make plan ENV=$ENV\` first" >&2
+  exit 1
+fi
+
+if [ -z "${ORCA_API_URL:-}" ]; then
+  echo "ORCA_API_URL not set." >&2
+  echo "M1.2 will provision the controller; until then \`make apply\` is a no-op." >&2
+  echo "Want to dry-run? Use \`make plan ENV=$ENV\` and inspect .orca-out/$ENV/." >&2
+  exit 0  # exit 0 — no-op is the expected M1.1 behaviour
+fi
+
+# Real apply once a controller exists. orca CLI deploys a directory of TOMLs.
+echo "=== apply ENV=$ENV against $ORCA_API_URL ==="
+orca --api "$ORCA_API_URL" deploy --file "$OUT"