feat: integrate Landing Zone Configurator MVP

[lweberru]

Scope

Integrate the optional Landing Zone Configurator without making the Terraform/OpenTofu Accelerator depend on the hosted application. Includes tenant-aware editor/API, versioned templates/Application contracts, isolated Runner/state workflows and bounded Assistant proposals.

Final fixes cover DNS roles/contact preservation, curated knowledge delivery to all Editor topics, foundation no-op preservation, Plan preparation/progress and same-tab STACKIT login.

CI, deployment and documentation

• Automatic change-aware Accelerator checks preserve the required Format, Validate, Configuration Tests and TFLint names. Comparison errors fail closed; Git pathspecs handle quoted/newline filenames.
• Relevant Configurator changes run catalogue, app, native-contract, PostgreSQL, browser and six mock-IaC checks.
• Configurator provisioning and deployment are exclusively manual. Source merge does not deploy or provision anything.
• Release builds independently repeat real-model qualification; unqualified/older builds cannot bypass promotion checks.
• Public user guide, architecture/diagrams and MVP limits are separated from contributor/operator references. CONTRIBUTING explains the full cross-component change chain; AGENTS.md points to the preserved Terraform style guide. Obsolete workstation/evidence artifacts are removed from the maintained tree; technical/design contracts remain.

Verified final source

c0e95ac88410435dc8186e6429ba12569d21b158

• All 13 final-revision CI checks passed.
• Local full application check: 809 passed, 64 intentional integration skips; separate CI integration/database steps passed.
• Operator helper guards: 27 passed. Release/change-scope guards: 12 passed, including actual workflow execution against disposable Git histories.
• Native format/init/validate and targeted Standalone/CLI/folder-description suite: 11 passed.
• Changed workflows pass actionlint; 163 local documentation links have valid targets.
• Secret scan has no new/unreviewed findings; its sole adjudicated result is the literal runner-test-only value in a mocked-provider fixture, not a credential.
• Real-model qualification: 114/114 (57 cases twice) and the complete 13/13 continuous journey, using the application defaults for both roles.
• Required human/code-owner approval and protected merge.

Native CI: https://github.com/stackitcloud/stackit-landing-zone/actions/runs/38898519075

Configurator CI: https://github.com/stackitcloud/stackit-landing-zone/actions/runs/38898519039

The qualified Assistant bundle remained unchanged throughout qualification; later commits affect CI only. Verification comments record fingerprints and the earlier 112/114 failed run (HTTP 503 and truncation). Failed receipts remain retained; the fresh complete qualification is a separate run, not a rewrite, hidden retry or relaxed oracle.

Acceptance boundaries

No application deployment, customer Apply or production setup occurred. Both execution paths were disabled during synthetic inference. This is bounded factual/contract evidence, not universal correctness or operational acceptance. Live requirements in #89, #90, #91, #93 and #95 stay open where evidence is missing. Follow-ups #19, #37, #96, #99, #100 and #101 are not silently closed. Main protection remains unchanged; no admin bypass is requested.

Closes #59
Closes #82
Closes #84
Closes #94

Related: #95.

[lweberru]

Integration verification update

Current source: bed0565. All native required checks, template-catalogue checks, six operator-IaC mock roots and the application job have passed. The application job includes the complete build/unit run, release guards, preparation/stateful-broker regressions, native template contracts, isolated PostgreSQL migration/tenant tests and desktop/mobile browser acceptance.

• Native CI: https://github.com/stackitcloud/stackit-landing-zone/actions/runs/38896854933
• Configurator CI: https://github.com/stackitcloud/stackit-landing-zone/actions/runs/38896854976
• Operator helper guards: 27 local tests; release/change-scope guards: 12 local tests. The latter execute the actual workflow Bash against synthetic Git histories, including unrelated docs/UI changes, native inputs, manual dispatch and failed comparisons.
• Final history secret scan has no new/unreviewed findings. Its one adjudicated result is the literal runner-test-only value in an existing mocked-provider test, not an operational credential.

Real-model qualification is not yet green

The first complete current-source run passed 112/114 cases. Its two failures were editor-audit-complete (upstream HTTP 503) and devops-git-advice (completion_truncated). Those receipts are retained as failures; no automatic retry, ignored iteration or relaxed oracle was introduced. The same-source 13-step journey passed, and two separate diagnostic Git-advice runs passed, but these do not replace a complete qualification.

A fresh complete repeated suite plus journey is running separately. The PR remains draft until that evidence is complete. No deployment, customer Apply, production setup or branch-protection bypass has occurred.

[lweberru]

Final real-model qualification

The fresh complete qualification passed 114/114 cases (57 cases, two independent iterations) and the continuous multi-topic journey passed 13/13, including local proposal acceptance, round-trip and native export. Both roles used the configured application default Qwen/Qwen3-VL-235B-A22B-Instruct-FP8; no CI-only classifier override was used.

• Knowledge SHA-256: ee51045fa0d249b535d9c449df1311af336ffd4daf44a1b67b1fc0852ee5c01b
• Suite SHA-256: bba638db669752c98b826684f0456cead383c02d249aad1899e56b565d3632a4
• Journey SHA-256: 9d9f48af245983fd6ab09f421606337d8f860315877763c1be323d260790db6e

Assistant source remained unchanged during qualification. Later commits affect only CI scope detection/tests, not this qualified Assistant bundle. The earlier 112/114 failed run and diagnostic receipts remain retained and documented above. Its HTTP 503/truncation failures were not converted into passes, hidden by retries or removed from the evidence.

This is bounded synthetic factual/contract evidence, not universal correctness or production acceptance. The release pipeline must independently qualify its exact build before promotion. No customer cloud operation or deployment was authorized by these receipts.