Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

pulumi-tests/.gitignore

@@ -0,0 +1,11 @@
+.env
+**/reports/*.xml
+**/reports/*.html
+**/reports/*.json
+pulumi/.pulumi-state/
+pulumi/.pulumi-work/
+pulumi/programs/**/.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+*.retry