feat: harness VM stack (runner, measure-db, blackbox, Alloy, k6) and the 12 scenarios

Experiment design 5 and 7 for the harness VM (10.20.0.11): vm/harness/apply.sh pulls the secrets from Secret Manager,
compose runs runner:de076a7, measure-db, blackbox, Alloy (probe_success -> Mimir) and k6 under the campaign profile.
Scenario files C-K1..X-M2 are loaded by the runner. Harness ClusterRole gains replicasets get/list for rollout undo.

vm/harness/config.alloy

@@ -0,0 +1,33 @@
+// Alloy on the harness VM: scrape blackbox (ALB probe 15s, db-primary tcp) and the runner, remote_write to Mimir.
+// Single tenant Mimir: no X-Scope-OrgID (design 4.1).
+prometheus.scrape "blackbox" {
+  job_name        = "blackbox"
+  metrics_path    = "/probe"
+  scrape_interval = "15s"
+  scrape_timeout  = "12s"
+  targets = [
+    { "__address__" = "blackbox:9115", "__param_module" = "http_2xx",    "__param_target" = "http://" + sys.env("ALB_DNS") + "/api/orders", "target" = "alb" },
+    { "__address__" = "blackbox:9115", "__param_module" = "tcp_connect", "__param_target" = "10.20.0.20:5432",                            "target" = "db-primary" },
+  ]
+  forward_to = [prometheus.remote_write.mimir.receiver]
+}
+
+prometheus.scrape "harness" {
+  job_name        = "harness"
+  scrape_interval = "15s"
+  targets         = [{ "__address__" = "runner:8080", "instance" = "harness" }]
+  forward_to      = [prometheus.remote_write.mimir.receiver]
+}
+
+prometheus.scrape "blackbox_self" {
+  job_name        = "blackbox-exporter"
+  scrape_interval = "60s"
+  targets         = [{ "__address__" = "blackbox:9115", "instance" = "harness" }]
+  forward_to      = [prometheus.remote_write.mimir.receiver]
+}
+
+prometheus.remote_write "mimir" {
+  endpoint {
+    url = "http://10.20.0.10:9009/api/v1/push"
+  }
+}