[wax911]

Implements #655 as a stacked PR on #669. It targets feat/platform-lab-654 so the implementation stays reviewable without waiting for the parent merge. Retarget after #669 merges.

Summary

• Add the resolved rehearsal/production HCloud intent schema, preflight validation, protected server/network/subnet/firewall/volume resources, conditional HCloud DNS RRsets, and schema-validated non-secret inventory.
• Enforce Hetzner volume constraints: 10 to 10,000 GB per volume, at most 16 volumes, and 10,000 GB aggregate per server.
• Normalize and validate provider labels, make CNAME targets absolute, and force server type/image changes through Pulumi replacement so production protection blocks them.
• Add Pulumi Cloud-only state and an explicit read-only preview wrapper for rehearsal/production. ENV=lab remains the local Docker fixture and previews only an existing active stack.
• Add platform-pulumi-test and platform-preview Make targets, docs, and offline CI coverage for Docker/HCloud Pulumi mocks plus platform Python tests.

Test Plan

• make platform-pulumi-test ENV=lab: 2 Docker mock tests, 15 HCloud mock tests, 42 Python tests passed.
• bash tools/ci/test-risk-review-scripts.sh: 19/19 passed with the pinned Python environment.
• python -m py_compile tools/platform/lab.py tools/platform/pulumi_preview.py, CI workflow YAML parse, make help, and git diff --check passed.
• Actual local T1 run 20261025T231730Z-d7d67cc7: doctor, up, no-op update, SSH, controlled update, lab preview, and down passed with DOCKER_CONTEXT=production while selecting and allowlisting the local default context. Lab preview reported 6 unchanged resources. Architecture was x86_64; fixture digest was sha256:0f535b0faa7448511b23528165e9fbd4f1fe563b861b3dcaa5ddb0ddbfe2254c.

Safety boundary

• No HCloud account preview or apply was invoked; no HCloud resources were provisioned.
• Hetzner Cloud Firewall egress remains provider-default allow-all because this intent contract has no outbound allowlist. Do not apply rehearsal or production resources until G0 records required outbound destinations and an authorized egress policy. This remains an explicit blocker, not a passed criterion.