Prepare 0.1.0 for lab release: durable handlers, HTTP Compose, CI, and pulumi-tests.

- Harden DB-backed handlers and seed profiles; align client wire shapes for
  cluster resources, QEMU config, and node SSL fields
- Serve plain HTTP on Compose :8006; keep TLS optional (--profile tls) and
  terminate HTTPS at Kubernetes Ingress
- Add pulumi-tests (full contract surface majors 6–9 + BPG lifecycle) and
  make pulumi-tests
- Ship bilingual docs, CHANGELOG, SECURITY, CONTRIBUTING, and GitHub Actions
  (make ci + Compose/Helm validation)

pyproject.toml

@@ -40,12 +40,16 @@ packages = ["app"]
 [tool.ruff]
 target-version = "py313"
 line-length = 100
+# Native client suites under pulumi-tests/ are generated and linted by their
+# own runners; keep the product CI gate focused on the simulator package.
+exclude = ["pulumi-tests"]
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "UP", "B", "ASYNC", "S", "RUF"]
 
 [tool.ruff.lint.per-file-ignores]
 "tests/**/*.py" = ["S101", "S105"]
+"examples/**/*.py" = ["S101", "S105", "S106"]
 
 [tool.mypy]
 python_version = "3.13"