Build the reproducible nightly environment and compatibility matrix

[litroc]

Context

Implements LI-121, MLX-100, and REL-30. Jira coordinates delivery; this English GitHub issue is the technical source of truth.

Scope

Provision a reproducible, digest-bound representative environment for fresh-install and upgrade validation across the supported ModuLix matrix.

Acceptance criteria

• Environment definition is versioned and digest-bound.
• Fresh install and upgrade from supported releases are reproducible.
• Supported Ansible, Python, OS, architecture, collection, and container profiles are covered.
• Infrastructure failures are distinguished from product failures.
• Secrets never appear in manifests, logs, or artifacts.
• Evidence is linked here and back to LI-121.