refactor: retire v1 repository paths

[bxvtr]

Summary

• retire historical V1 workload overlays for PostgreSQL, MLflow, and monitoring
• remove superseded Bash bootstrap/runtime mutation paths
• remove the obsolete repository-local OCI secrets provider manifests now that V2 uses the Argo-managed Helm provider path
• replace historical V1 CI validation with fail-closed retired-path contracts
• preserve the active V2 application, Argo, clean-room automation, private-runtime, and OCI secrets contracts

Validation

• independent PRE-COMMIT review: BLOCKER=0, HIGH=0, MEDIUM=0, LOW=0
• git diff --cached --check
• ./tools/validate-safe
• ./tests/unit/test_retired_v1_paths_contract.sh
• ./tests/unit/test_clean_room_automation_contract.sh
• ./tests/unit/test_ansible_k8s_runtime_contract.sh
• ./tests/unit/test_private_runtime_vault_ocid_contract.sh

Local ShellCheck / Kustomize / Helm tooling was unavailable; required repository CI is the authoritative gate.

Deferred

• live OCI V1 retirement audit / cleanup
• historical V1 migration-document retirement
• final V2 clean-room runbook / roadmap / release-status cleanup
• Terraform lockfile decision
• repository governance consolidation