feat: harness VM stack (runner, measure-db, blackbox, Alloy, k6) and the 12 scenarios

Experiment design 5 and 7 for the harness VM (10.20.0.11): vm/harness/apply.sh pulls the secrets from Secret Manager,
compose runs runner:de076a7, measure-db, blackbox, Alloy (probe_success -> Mimir) and k6 under the campaign profile.
Scenario files C-K1..X-M2 are loaded by the runner. Harness ClusterRole gains replicasets get/list for rollout undo.

vm/harness/scenarios/V-G1.yaml

@@ -0,0 +1,16 @@
+# design 7 V-G1: grey zone, VM. tc netem delay 400ms on one legacy instance; health check passes, /api/price p95 breaks. Correct: mig.recreate_instance after approval.
+id: V-G1
+path: gray
+asset: vm
+expected_layer: 2
+ground_truth_label: network_latency_legacy
+ground_truth_action: mig.recreate_instance
+description: tc qdisc add dev ens4 root netem delay 400ms on legacy instance 0
+inject:
+  method: ssh
+  host: legacy:0
+  command: sudo tc qdisc add dev ens4 root netem delay 400ms
+revert:
+  method: ssh
+  host: legacy:0
+  command: sudo tc qdisc del dev ens4 root || true