feat: harness VM stack (runner, measure-db, blackbox, Alloy, k6) and the 12 scenarios

Experiment design 5 and 7 for the harness VM (10.20.0.11): vm/harness/apply.sh pulls the secrets from Secret Manager,
compose runs runner:de076a7, measure-db, blackbox, Alloy (probe_success -> Mimir) and k6 under the campaign profile.
Scenario files C-K1..X-M2 are loaded by the runner. Harness ClusterRole gains replicasets get/list for rollout undo.

vm/harness/k6/load.js

@@ -0,0 +1,37 @@
+// Background load of experiment design 5.5: constant-arrival-rate 20 rps, /api/orders 70% and /api/price/{item} 30%.
+// Thresholds mirror the SLO (p95 < 500ms, failures < 1%); a breach makes k6 exit non-zero at the end of the run
+// (the SLO verdict itself is the harness judge's Mimir query, design 4.2).
+import http from 'k6/http';
+import { check } from 'k6';
+
+const base = __ENV.ALB_URL;
+const items = ['apple', 'banana', 'cherry'];
+
+export const options = {
+  scenarios: {
+    background: {
+      executor: 'constant-arrival-rate',
+      rate: 20,
+      timeUnit: '1s',
+      duration: __ENV.K6_DURATION || '12h',
+      preAllocatedVUs: 20,
+      maxVUs: 50,
+    },
+  },
+  thresholds: {
+    http_req_duration: ['p(95)<500'],
+    http_req_failed: ['rate<0.01'],
+  },
+};
+
+export default function () {
+  const r = Math.random();
+  let res;
+  if (r < 0.7) {
+    res = http.get(`${base}/api/orders`, { tags: { route: 'orders' } });
+  } else {
+    const item = items[Math.floor(Math.random() * items.length)];
+    res = http.get(`${base}/api/price/${item}`, { tags: { route: 'price' } });
+  }
+  check(res, { 'status 200': (x) => x.status === 200 });
+}