chore: finalize v2 clean-room reproducibility

[bxvtr]

Summary

• add and enforce the tracked Terraform OCI provider lockfile for supported Linux amd64/arm64 execution
• finalize docs/V2_CLEAN_ROOM_DEPLOYMENT.md as the single canonical V2 operator runbook
• align Terraform/operator documentation with the proven clean-room automation, ownership, idempotency, reboot, and destroy contracts
• preserve external foundation ownership boundaries for Vault, secret values, and Terraform state

Validation

Independent PRE-COMMIT review:

• BLOCKER=0
• HIGH=0
• MEDIUM=0
• LOW=2
• INFO=1
• APPROVED FOR COMMIT

Local validation included:

• git diff --cached --check
• ./tools/validate-safe
• Terraform 1.15.8 backend-disabled init / fmt / validate
• ./tests/unit/test_terraform_lockfile_contract.sh
• ./tests/unit/test_clean_room_automation_contract.sh
• ./tests/unit/test_cloud_shell_execution_contracts.sh
• Ansible/runtime/monitoring/security contract tests

ShellCheck was unavailable locally.

Scope

This PR does not:

• close the final V2 roadmap/release status
• rewrite broad CHANGELOG history
• retire/archive historical V1 migration documents
• change governance
• change runtime architecture
• perform live infrastructure mutations

Accepted review notes

Two LOW documentation wording observations remain intentionally unchanged because
they are non-blocking and the staged diff has already passed independent review.