infra: modules-first environments and RPC Durable Object coordinator

[ORESoftware]

Make modules/ the canonical provider-native infrastructure root and add isolated Terraform environments without duplicate root-level provider configuration.

Provider-native roots: Supabase Working directory modules -> modules/supabase/; Cloudflare Root directory per deployable under modules/cloudflare/<worker-or-site>; Neon project root modules/neon -> modules/neon/neon.ts.

This PR includes .ores-infra.toml, environments/{preview,staging,production}, R2/S3 state guidance, reusable Cloudflare Terraform helpers, and a SQLite-backed ZedPackageCoordinator Durable Object.

The coordinator is RPC-first: it inherits DurableObject and exposes health, versioned compare-and-set, renewable leases, and fencing-token release. Unit tests cover protocol validation/expiry/version semantics; CI generates Wrangler binding types and performs a preview dry-run alongside Terraform fmt/init/validate.

Wrangler/Workers Builds remains the sole writer for Worker source, bindings, and Durable Object lifecycle; Terraform does not duplicate it.

Exact-head evidence: infra-layout-validate is green, including Terraform and Cloudflare RPC/dry-run checks. The separate legacy ci workflow remains red on an existing workers/ npm audit (miniflare -> sharp) and is not caused by this modules-first change.

[ORESoftware]

*-test adversarial evidence: zed-pkg-test/security-adversarial-e2e#16 is green on test head 588fabeeb65d3bf020ab5db2fd5896fd93182844, pinned to this PR source head 32417ec. The sibling-org test found a real pre-existing gap in the new coordinator contract: the original key regex rejected npm scoped package names such as @scope/package. This PR was fixed to accept scoped package keys (and + for ecosystem-realistic resource names) while still rejecting traversal/backslashes/oversized identifiers. The test-org lane now passes adversarial key cases, TTL boundaries, fencing invariants, source coordinator checks, Wrangler class/binding parity, and actual local workerd ZedPackageCoordinator instantiation. Production infra-layout-validate is also green on the fixed head; the remaining legacy ci red is its existing edge-worker dependency audit, not the coordinator lane.

[ORESoftware]

Governance sweep 2026-09-14: converted to draft because GitHub currently reports the PR non-mergeable and the PR records a red legacy ci lane (workers/ npm audit via miniflare -> sharp) even though the dedicated infra-layout validation is green. Preserve the modules-first/Terraform/DO work, but do not promote until mergeability is restored and the red legacy gate is resolved or explicitly replaced by reviewed policy.

[ORESoftware]

Exact-head follow-up (2026-09-15 UTC): all current infrastructure/layout/formal checks are green; the only executed CI blocker is edge-workers at npm audit. The vulnerable chain is miniflare 5.20260828.0-alpha -> sharp <0.35.4 (high severity). npm proposes miniflare 5.20260911.1-alpha, which is a breaking upgrade, so this should be validated with the existing Worker unit/runtime/type suites and lockfile regeneration rather than bypassing or lowering the audit threshold.

[ORESoftware]

Conflict resolution is now validated on exact head cf6d55474fccae8da85c1d151bff7f5dd10ad83f: Terraform layout, infra-layout validation, source policy, isolation contracts, Shared Auth topology, agents policy, and formal edge-handshake workflows all pass after the two-parent semantic merge. The only red CI job is edge-workers, and it fails specifically at npm audit: current miniflare resolves sharp <0.35.4 with two high-severity advisories; npm proposes breaking upgrade miniflare@5.20260911.1-alpha. I did not lower the audit threshold or hand-edit workers/package-lock.json. Keep this draft until the miniflare upgrade is performed with a real npm lock regeneration and Worker tests.