[P1][Post-0.5][Full C] Implement cloud-neutral workspace-node provisioning and reconciliation

[mightnent]

Parent epic: #82

Outcome

Introduce a cloud-neutral, idempotent provisioner/reconciler boundary that turns explicit operator or entitlement requests into durable workspace-node capacity and safely reports drift and failure.

Execution

• Priority: P1 post-0.5 Full C automation.
• Deployment profiles: Hosted required. Customer-managed deployments must continue to operate without an automated provisioner.
• Worktree boundary: Provisioning request model, provisioner interface, reconciliation jobs, retries, external-node import, drift/orphan reporting, audit, and focused tests. Cloud-specific resource creation remains in the deployment owner.

Scope

• Create durable provisioning requests only from an explicit entitlement or authorized platform-operator action, never from SSO or tenant creation alone.
• Define an idempotent desired-state contract for automated and externally provisioned nodes.
• Track pending, running, failed, stuck, superseded, and completed attempts with safe retries.
• Reconcile desired capacity, logical node, infrastructure attachment, bootstrap state, workspace inventory, reservations, and purge completion.
• Detect orphan resources, missing workspaces, duplicate claims, placement drift, and incomplete purge without taking unsafe destructive action.
• Keep provider attachment identifiers as operator metadata and cloud credentials outside the product database.

Non-goals

• Encoding AWS instance, subnet, certificate, or storage APIs into product tenant/workspace contracts.
• Placement scoring, transparent failover, or workspace storage migration.
• Treating infrastructure attachment identity as the stable logical node ID.

Definition of success

• Repeated reconciliation converges idempotently without duplicate capacity, nodes, assignments, or audit events.
• Explicit entitlement/operator requests and externally provisioned imports follow the same logical-node contract.
• Failed, stuck, retried, superseded, and completed attempts are operator-visible and auditable.
• Drift/orphan detection is secret-free and does not delete or reassign stateful resources automatically.
• Customer-managed single-node deployments remain usable without this reconciler.
• Focused provisioner/reconciler tests, relevant database tests, and npm run verify:quick pass on the exact candidate SHA.