feat: harness VM stack (runner, measure-db, blackbox, Alloy, k6) and the 12 scenarios

Experiment design 5 and 7 for the harness VM (10.20.0.11): vm/harness/apply.sh pulls the secrets from Secret Manager,
compose runs runner:de076a7, measure-db, blackbox, Alloy (probe_success -> Mimir) and k6 under the campaign profile.
Scenario files C-K1..X-M2 are loaded by the runner. Harness ClusterRole gains replicasets get/list for rollout undo.

vm/harness/scenarios/C-I1.yaml

@@ -0,0 +1,15 @@
+# design 7 C-I1: irreversible, container. Schema change on db-primary (DROP COLUMN status). Layer 2 diagnoses -> escalate -> a human restores (db.data_fix).
+# Runs as the postgres OS user over SSH (the harness DB role has SELECT only). Revert: the human re-adds the column; recorded via /actions/execute db.data_fix.
+id: C-I1
+path: irreversible
+asset: container
+expected_layer: 3
+ground_truth_label: schema_mismatch
+ground_truth_action: escalate
+description: ALTER TABLE app.orders DROP COLUMN status on db-primary
+inject:
+  method: ssh
+  host: db-primary
+  command: sudo -u postgres psql -d app -v ON_ERROR_STOP=1 -c "ALTER TABLE app.orders DROP COLUMN status"
+revert:
+  method: none