feat: add capi-cluster module for Cluster API manifests

[bloogefest]

Summary

New module modules/capi-cluster renders Cluster API manifests for workload clusters from the cluster description.
It has no providers: the GitOps repository commits the output and Argo CD in the management cluster applies it.

• CAPI 1.14 (v1beta2); Proxmox VE through CAPMOX 0.9.1, OpenStack (Selectel, VK Cloud) through CAPO 0.15.0.
• Talos (CABPT 0.6.13, CACPPT 0.5.14) reusing the talos-cluster/config documents; kubeadm with kube-vip on Proxmox.
• Images by the exact tag set (Proxmox) or name (OpenStack) of the images contract.
• MachineDeployment per pool with Cluster Autoscaler bounds and capacity, MachineHealthCheck, content-hashed
  template names.
• New rules capi-single-provider and capi-distribution (cluster-spec and Conftest); the Astra pool of main
  moves to the new reference cluster astra.
• tools/check-capi.sh in CI: renders the scenarios and validates them with kubeconform against the CRDs of the
  pinned provider releases.
• talos-cluster/config: external_cloud_provider.
• ADR 0006, configuration, usage, architecture and troubleshooting pages, CHANGELOG, ROADMAP.

Checks

• tofu fmt -check, tofu validate, tofu test for affected modules
• tflint, Checkov, Conftest policies and fixtures
• yamllint, actionlint, zizmor
• gitleaks: no secrets, no personal values (addresses, domains, IDs)
• Versions pinned exactly (README → Versions)
• Module README (terraform-docs), docs/configuration.md, CHANGELOG updated
• Contracts (cluster description, node, inventory) unchanged, or the change is agreed and has an ADR
• Both topologies (single, ha) covered where applicable