Implement initial setup for local validation

[artemnikitin]

Summary

Adds the first local-only Firework validation harness from #42/#15.

• Runs one combined control plane with registry, events, controller, and API roles.
• Runs two isolated agent nodes with networking between them.
• Creates a disposable real S3 bucket for control-plane state and rendered node configs.
• Uses ephemeral mTLS certificates and bootstrap tokens for node enrollment.
• Reconciles a local Git workload with caller/responder Firecracker VMs, anti-affinity, and a cross-node request.
• Supports native Linux and an Apple Silicon Lima adapter.
• Collects redacted diagnostics, network state, S3 inventory, logs, and a cleanup manifest.

CI integration is intentionally deferred to Milestone 2; this PR focuses on making the complete flow runnable locally first.

Usage

Set the Linux Firecracker binary, kernel, rootfs, and AWS region, then run:

export FIREWORK_E2E_FIRECRACKER_BIN=/path/to/firecracker
export FIREWORK_E2E_KERNEL=/path/to/vmlinux
export FIREWORK_E2E_ROOTFS=/path/to/rootfs.ext4
export AWS_REGION=us-east-1
make validate-e2e-local

The rootfs must be an ext4 image containing BusyBox. The runner copies it before injecting the local test init, so the supplied image is not modified. FIREWORK_E2E_KEEP=1 retains the lab and bucket for inspection; the generated manifest provides the cleanup command.

See validation/e2e-local/README.md for prerequisites and platform options.

Verification

• make test
• make build-linux-amd64
• make build-linux-arm64
• bash -n validation/e2e-local/scripts/*.sh
• ShellCheck
• git diff --check

The privileged Firecracker/S3 end-to-end run still requires a Linux KVM environment or Lima plus AWS credentials and local Firecracker assets; it was not executed in the development sandbox.