feat(runtime): add OCI JIT shadow preflight

[Pigbibi]

Summary

• add a non-applying OCI JIT shadow contract for private subnet, reserved NAT egress, defined-tag ownership, least-privilege instance principal, one-job runner, and terminate-with-boot-volume-deletion
• add a redacted preflight/orphan-audit tool that records no resource values, never deletes resources, and parks incomplete or stale inventory
• add a manual read-only/no-secret workflow that renders terminal preflight evidence, exercises the orphan checker, and runs the fixed-input no-order shadow
• document every operator-provided repository variable and the remaining boundary before provisioning

Safety boundary

This PR creates no OCI resource, IAM policy, runner, network, Vault secret, allowlist entry, or live change. The workflow has no OIDC or broker secret and the contract keeps apply_authorized=false. Actual OCI inventory must be exported with read-only access; the committed clean fixture proves only the checker.

Validation

• python -m unittest tests.test_runtime_isolation_shadow tests.test_runtime_isolation_host_probe tests.test_oci_jit_shadow_preflight -v (15 passed)
• rtk ruff check scripts/oci_jit_shadow_preflight.py tests/test_oci_jit_shadow_preflight.py
• actionlint v1.7.12 on .github/workflows/oci-jit-shadow-preflight.yml
• python -m py_compile scripts/oci_jit_shadow_preflight.py tests/test_oci_jit_shadow_preflight.py
• git diff --check