feat: harness VM stack (runner, measure-db, blackbox, Alloy, k6) and the 12 scenarios

Experiment design 5 and 7 for the harness VM (10.20.0.11): vm/harness/apply.sh pulls the secrets from Secret Manager,
compose runs runner:de076a7, measure-db, blackbox, Alloy (probe_success -> Mimir) and k6 under the campaign profile.
Scenario files C-K1..X-M2 are loaded by the runner. Harness ClusterRole gains replicasets get/list for rollout undo.

vm/harness/compose.yaml

@@ -0,0 +1,66 @@
+# Harness VM (10.20.0.11), experiment design 5.1: runner 8080, measure-db (internal), blackbox 9115, k6 (campaign profile),
+# plus Alloy that scrapes blackbox/runner into Mimir (design 4.1 synthetic probe -> probe_success).
+services:
+  runner:
+    image: asia-northeast1-docker.pkg.dev/cms-d-414903/selfheal-public/harness:${HARNESS_TAG}
+    container_name: runner
+    restart: always
+    env_file: /opt/selfheal/harness.env
+    environment:
+      MEASURE_DSN: "postgres://harness:${MEASURE_DB_PASSWORD}@measure-db:5432/harness?sslmode=disable"
+      SCENARIO_DIR: /etc/harness/scenarios
+    volumes:
+      - /opt/selfheal/harness/secrets:/run/secrets:ro
+      - ./scenarios:/etc/harness/scenarios:ro
+    ports:
+      - "8080:8080"
+    depends_on: [measure-db]
+  measure-db:
+    image: postgres:16.15-alpine
+    container_name: measure-db
+    restart: always
+    environment:
+      POSTGRES_USER: harness
+      POSTGRES_PASSWORD: "${MEASURE_DB_PASSWORD}"
+      POSTGRES_DB: harness
+    volumes:
+      - measure-data:/var/lib/postgresql/data
+  blackbox:
+    image: prom/blackbox-exporter:v0.28.0
+    container_name: blackbox
+    restart: always
+    command: ["--config.file=/etc/blackbox.yaml"]
+    volumes:
+      - ./blackbox.yaml:/etc/blackbox.yaml:ro
+    ports:
+      - "9115:9115"
+  alloy:
+    image: grafana/alloy:v1.19.2
+    container_name: alloy
+    restart: always
+    command: ["run", "--server.http.listen-addr=0.0.0.0:12345", "--storage.path=/var/lib/alloy/data", "/etc/alloy/config.alloy"]
+    environment:
+      ALB_DNS: "${ALB_DNS}"
+    volumes:
+      - ./config.alloy:/etc/alloy/config.alloy:ro
+      - alloy-data:/var/lib/alloy/data
+    ports:
+      - "12345:12345"
+    depends_on: [blackbox]
+  k6:
+    # background load of design 5.5; started only for campaigns: docker compose --profile campaign up -d k6
+    image: grafana/k6:2.3.0
+    container_name: k6
+    profiles: [campaign]
+    restart: "no"
+    command: ["run", "--summary-export=/logs/summary.json", "/scripts/load.js"]
+    environment:
+      ALB_URL: "http://${ALB_DNS}"
+      K6_DURATION: "${K6_DURATION:-12h}"
+    volumes:
+      - ./k6:/scripts:ro
+      - k6-logs:/logs
+volumes:
+  measure-data: {}
+  alloy-data: {}
+  k6-logs: {}