[major] Harden the modular cloud runtime foundation

[libops-agent]

Summary

• split provider entrypoints from the shared runtime contract and align Terraform, Ansible, and Salt package semantics
• harden Direct VPC egress, per-instance power IAM, host artifacts, rootfs verification, and privileged runtime boundaries
• keep archive-backed Linode cloud-init below the 16 KiB encoded metadata limit without executing unverified helpers
• move lifecycle serialization to a root-owned /run/lock/cloud-compose tmpfiles contract that converges on COS, Ansible, and Salt upgrades
• remove the module-wide PPB dependency that cycled through a deposed GCP VM while preserving instance-scoped IAM rebinding
• force a complete offline ext4 check before resizing preserved disks, and fail closed before rootfs or application writes when required mounts are unavailable
• pin terraform-cloudrun-v2 to reviewed release commit 1f077af2e531266fb6927803ad42e6b9ed140d07 (v0.6.0)
• add upgrade, provider, configuration-management, security, documentation, and cleanup contracts for the 1.0 transition

Verification

• 37 GCP Terraform tests, including forced VM replacement while retiring the Vault signer
• 7 Linode, 3 DigitalOcean, and 15 shared Linux runtime Terraform tests
• full local Terraform validation across every root, plus GCP upgrade, filesystem, source-trust, host-security, systemd, and cleanup contracts
• full Ansible/Salt smoke, including lock creation, repair, cross-user contention, symlink rejection, and no-op Salt convergence
• documentation build completed with no issues using the same container image as CI
• hosted actionlint, ShellCheck, Terraform docs, and real provider smoke tests remain required merge gates

Merge gates

• every hosted check must pass, including the preserved-disk GCP 0.10.2 upgrade smoke
• publish PPB v0.5 to GAR with its immutable digest before replacing the currently pinned v0.4.2 image

Completed gates: protected provider environments are configured and terraform-cloudrun-v2 v0.6.0 is published and pinned by immutable commit.

Latest hosted regression gate: the preserved-disk COS replacement exposed the documented noexec policy on /home and /var. Commit 70fefeb moves verified GNU Make state to the executable persistent data disk, rejects noexec overrides before cached acceptance or Docker execution, and adds a dynamic contract.
Second hosted regression gate: the COS replacement also exposed that the platform jq build omits Oniguruma. Commit 0e23776 removes every regex-dependent jq runtime filter, preserves strict Bash allowlists and trailing-byte validation, rejects NUL input before Bash extraction, and adds hostile-input plus COS-portability contracts.
Third hosted regression gate: Ubuntu jq 1.6 incorrectly treats every non-empty string as containing a NUL when contains("\u0000") is used. Commit 686e2c7 replaces deployed NUL checks with code-point inspection, tests all affected contracts under jq 1.6, and prevents that predicate from returning.
Fourth hosted regression gate: the 0.10.2 upgrade proved that direct public Cloud Run appends the real client at the right edge of X-Forwarded-For. Commit b40b45f restores the explicit depth-zero contract, keeps the hostile-prefix single-request test, validates the value consistently at every Terraform entrypoint, and distinguishes public Cloud Run ingress from Direct VPC egress and VM firewall ingress.

Remaining external release gate: PPB 0.5.0 is released, but its dedicated GAR publisher Terraform is merged and not yet applied. The module remains pinned to immutable PPB 0.4.2 until an authorized bootstrap operator applies that publisher and the 0.5.0 GAR build succeeds; this PR must not merge while its documented fail-closed/retry contract exceeds the pinned image.

[libops-agent]

Hosted run 29274580854 completed on b40b45fa20886a92e1d0c4d4e1cc4544488c8006. Terraform lint, Ansible/Salt lint, all three Linode smokes, and DigitalOcean ISLE passed; GCP cleanup verified that no matching resources remained. The GCP upgrade reached a healthy WordPress stack, stopped the VM, then its single adversarial cold request returned HTTP 502 after the v0.4.2 PPB dial window. This is the expected remaining PPB 0.5.0 publication gate: the pinned 0.4.2 binary does not honor the configured power-on retry fields. Do not weaken the one-request smoke or merge this PR until the dedicated publisher is applied, PPB 0.5.0 is green in GAR, and the resulting digest-pinned rerun passes.