feat(cyborg): implement RAES scenario projection

[Brad-Edwards]

Summary

Implement an evidence-backed CybORG Provisioner that projects complete RAES provisioning plans into configurable native CybORG scenarios, with reproducible construction, bounded portable artifacts, and a capability manifest proven by executable qualification.

Requirement UIDs

• REP-004

Related Issues

Closes #15

ADR Impact

• RAES ADR-069
• ADR-002
• ADR-003

Changes

• Translate supported RAES switches, VM counts, links, operating-system facts, and seeds into generated CybORG scenario documents without pinning runtime behavior to Scenario2.
• Validate the full compiled desired-state shape and fail closed on unsupported or lossy semantics before native side effects.
• Construct the pinned CybORG source from a private re-verified source-only snapshot and retain native state behind the driver boundary.
• Publish the provisioning-only backend manifest, realization envelope, portable snapshots, documentation, and detached real-CybORG qualification evidence.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Configured completion command passes
• No coverage regression

Canonical nox -s verify passed: 137 tests in both base and CybORG dependency lanes, detached source build/install and native scenario qualification, 88% coverage, type/policy/package identity checks, and strict documentation build.

Ground Control Checks

• Configured repository policy command passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: src/raes_adapters/cyborg/scenario.py, src/raes_adapters/cyborg/driver.py, src/raes_adapters/cyborg/provisioner.py, src/raes_adapters/cyborg/manifest.py, src/raes_adapters/cyborg/target.py
• TESTS: tests/test_cyborg_provisioner.py, tools/verify_cyborg_qualification.py

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.