[major] Isolate cloud providers and harden smoke cleanup

[libops-agent]

Summary

• isolate the compatibility root to GCP while preserving module.gcp[0]; DigitalOcean and Linode remain under their explicit provider entrypoints
• enforce each public entrypoint's real transitive Terraform provider graph and document/test the 1.x non-GCP state migration
• move hosted DigitalOcean/Linode/GCP cleanup discovery, pagination, retries, and ownership checks from Bash into the tested Go runner
• pin cloud-compose templates to the released compose v1.0.0 and sitectl/plugin release set

Validation

• go test -count=1 -race ./...
• go vet ./...
• make terraform-validate
• make gcp-upgrade-smoke-contract
• make actionlint
• make terraform-docs-check
• terraform fmt -check -recursive
• git diff --check

The [major] title intentionally selects the hosted 0.10.2-to-current GCP root-module upgrade smoke. Provider cloud smokes are left to GitHub Actions.