Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

app/contracts/runtime.py

@@ -14,6 +14,7 @@ from app.api.registry import (
     HandlerRegistry,
     register_contract_routes,
     register_legacy_handler_routes,
+    register_unbound_handler_routes,
 )
 from app.compatibility import (
     CompatibilityDimension,
@@ -106,7 +107,7 @@ def apply_runtime_contract(
 
     clear_contract_routes(app)
     registered = register_contract_routes(app, snapshot, handlers, fallback)
-    register_legacy_handler_routes(
+    registered = register_legacy_handler_routes(
         app,
         handlers,
         store_root,
@@ -114,6 +115,7 @@ def apply_runtime_contract(
         primary_version=snapshot.source_version,
         existing=registered,
     )
+    register_unbound_handler_routes(app, handlers, fallback, existing=registered)
     report = build_compatibility_for_snapshot(
         snapshot,
         handlers,