Add validated multi-cloud deployment templates

[Jason-Doyle]

Summary

• Add one shared deployment contract for bootstrap, migrations, API, worker, PostgreSQL, secrets, TLS, health, and artifact filesystem semantics.
• Add a Kubernetes 1.29+ Helm chart with runtime/admin secret separation, native database-proxy sidecars, migration hooks, RWX storage, TLS-only ingress, and optional policy controls.
• Add an Azure Container Apps Bicep workload module using Azure Files NFS, separate managed identities, Key Vault references, manual gated jobs, and conditional ingress.
• Add an AWS ECS Fargate OpenTofu module using EFS, scoped Secrets Manager references, one-shot task definitions, ALB integration, and two-phase rollouts.
• Add a GKE OpenTofu module using the Helm chart, Cloud SQL Auth Proxy, Workload Identity, Filestore, NEG-backed ingress, and explicit TLS.
• Add the idempotent bootstrap-role command, client-side SCRAM verifier generation, runtime privilege reconciliation, managed PostgreSQL CA support, URL-level TLS override rejection, and certificate hostname/IP verification.
• Package all templates and add pinned Helm, Bicep, and OpenTofu validation to CI.

Boundaries

• These are workload modules, not organizational landing zones.
• Existing private PostgreSQL 18, networking, secret stores, TLS, and compatible shared filesystems are required.
• Cloud credentials and generated secrets never enter committed examples or OpenTofu state.
• Example IaC inputs are disabled comments until operators provide real values.

Validation

• 42 release and PostgreSQL tests
• Package runtime and type smoke tests
• Helm tag and digest rendering with secret-boundary assertions
• Azure Bicep compilation
• AWS and GCP OpenTofu formatting, initialization, and validation
• Three-run live and published SRE benchmark verification
• Production container build and bootstrap-role CLI check