Fix OCI instance PV encryption create contract

[bxvtr]

Summary

• move OCI instance PV encryption-in-transit configuration to the supported top-level create argument
• remove the unnecessary launch_options block that caused fresh instance creation to fail with the pinned OCI provider
• preserve encrypted paravirtualized scratch attachment behavior
• update static regression coverage for the corrected Terraform structure

Root cause

A real empty-state clean-room apply reached OCI instance creation and failed because the instance request included LaunchOptions without NetworkType. The repository had used launch_options solely to express PV encryption.

Validation

Implementation/review validation actually run (static; no live OCI):

• ./tests/unit/test_terraform_pv_encryption_contract.sh passed
• ./tools/check-agent-safety passed
• ./tests/unit/test_agent_safety.sh passed
• ./tools/check-sensitive-metadata passed
• ./tests/unit/test_sensitive_metadata_contract.sh passed
• ./tools/validate-safe passed (ShellCheck SKIP: not installed locally)
• local Terraform validation was unavailable in the implementation environment (terraform binary not installed); CI remains the terraform init -backend=false / terraform validate path

Independent PRE-COMMIT review of the exact staged diff:

• BLOCKER 0
• HIGH 0
• MEDIUM 0
• APPROVED FOR FINALIZATION

Live acceptance

The renewed clean-room apply has not yet been performed. Live validation resumes only after this fix is merged and main CI is green.