feat: harness VM stack (runner, measure-db, blackbox, Alloy, k6) and the 12 scenarios

Experiment design 5 and 7 for the harness VM (10.20.0.11): vm/harness/apply.sh pulls the secrets from Secret Manager,
compose runs runner:de076a7, measure-db, blackbox, Alloy (probe_success -> Mimir) and k6 under the campaign profile.
Scenario files C-K1..X-M2 are loaded by the runner. Harness ClusterRole gains replicasets get/list for rollout undo.

vm/harness/scenarios/X-M2.yaml

@@ -0,0 +1,17 @@
+# design 7 X-M2: misjudge probe, VM. 50% packet loss for 90s on one legacy instance; observe whether MIG autohealing recreates it for a transient fault.
+id: X-M2
+path: misjudge
+asset: vm
+expected_layer: 1
+ground_truth_label: transient_loss_legacy
+ground_truth_action: none
+description: tc netem loss 50% for 90s on legacy instance 0
+inject:
+  method: ssh
+  host: legacy:0
+  command: sudo tc qdisc add dev ens4 root netem loss 50%
+  wait_s: 90
+revert:
+  method: ssh
+  host: legacy:0
+  command: sudo tc qdisc del dev ens4 root || true