feat: add resumable clean-room automation

[bxvtr]

Summary

• add resumable Cloud Shell clean-room bootstrap, deployment, and verification tools;
• preserve state-aware rerun semantics instead of persistent workflow-step markers;
• retain explicit APPLY, FORMAT, and REBOOT operator safety gates;
• add optional tmux resilience warnings;
• update Cloud Shell readiness for the live-proven Python 3.12 control-node contract;
• add stubbed regression coverage and CI wiring.

Safety

• no production Terraform/Ansible/GitOps architecture redesign;
• no automatic destructive Terraform behavior;
• no automatic scratch formatting;
• no automatic reboot;
• no Monitoring/PostgreSQL recovery hacks;
• private runtime values remain file-based and outside Git.

Test plan

• clean-room automation contract tests;
• Cloud Shell execution contracts;
• Ansible Kubernetes runtime contracts;
• agent safety;
• sensitive metadata;
• repository safe validation;
• ShellCheck covered by CI.

This PR is statically/stub validated. It does not itself perform a live deployment. The underlying manual clean-room workflow was live-proven separately.