feat: extract Forge into standalone repository

[nerdalert]

Summary

Extract Forge from Grid into the standalone praxis-proxy/forge repository.

Forge is now an independently buildable, project-neutral CLI for provisioning
reproducible local Kubernetes environments using Docker/Podman, Kind clusters,
host services, and declarative forge.yaml deployment stacks.

This PR preserves the existing CLI and configuration behavior while adding
standalone packaging, compatibility fixtures, path-independence tests, release
automation, MSRV validation, and supply-chain checks.

Scope

Included:

• Standalone Rust workspace and praxis-forge binary.
• Source extraction from Grid’s in-tree forge crate.
• No dependencies on Grid crates, workspace paths, or Grid runtime components.
• Existing CLI compatibility:
  • config validate
  • config show
  • config schema
  • up
  • down --force
  • stack apply
  • status
  • cluster and service commands
  • non-interactive execution
• Versioned forge.yaml schema validation.
• Relative asset resolution from the supplied configuration directory.
• State, evidence, ownership, and cleanup behavior.
• Atomic state, kubeconfig, and rendered-template writes with fsync.
• Compatibility fixtures for:
  • Grid GLB;
  • Grid workload inference;
  • Grid combined site;
  • Grid llm-d pool metrics;
  • MaaS/IPP.
• Binary path-independence tests from foreign working directories.
• Standalone release profile and --version support.
• Linux x86_64 and aarch64 release workflow.
• SHA-256 release checksums.
• Build provenance attestation.
• SHA-pinned GitHub Actions.
• Rust 1.96 MSRV workflow.
• cargo audit and cargo deny supply-chain checks.
• Standalone README, CONTRIBUTING.md, and SECURITY.md.

Compatibility and boundary decisions

Forge remains project-neutral. The following stay outside Forge:

• Grid routing and scoring assertions;
• Grid SWIM behavior;
• Grid operator deployment semantics;
• Grid overlay assertions;
• Grid-specific topology orchestration;
• MaaS/IPP runtime assertions.

Grid, demos, and MaaS/IPP continue to define their own Forge configurations and
topology-specific validation.

The in-tree grid/forge crate remains in place intentionally. Consumer
migration and removal are deferred until standalone runtime parity is
reviewed and accepted. The Grid and MaaS demos have been validated with this branch.
Once this gets cut, we will convert the demos to use this.

Runtime parity

Parity comparisons were performed against the in-tree Grid Forge binary.

Results:

• No Forge-attributable regressions.
• No standalone-versus-in-tree parity mismatches.
• Identical environment failures reproduced with both binaries.
• Grid GLB full demo completed.
• Grid combined-site quick and full demos completed.
• Grid workload-inference exercised with identical standalone/in-tree results.
• Forge configuration validation and dry-run lifecycle behavior passed against
  real Grid configurations.
• Existing Grid and demos repositories were not modified.

Validation

The standalone test suite includes:

• unit tests;
• CLI integration tests;
• compatibility fixture tests;
• path-independence tests.

Issue tracking

This PR implements the standalone extraction/bootstrap, compatibility, packaging,
and validation portions of issue #30.

It intentionally does not close issue #30 because the following phases remain:

1. Grid consumer migration to a pinned standalone Forge release.
2. Public demos migration.
3. MaaS/IPP migration.
4. Full runtime parity matrix completion.
5. Deprecation and eventual removal of the in-tree Grid Forge crate.
6. Migration documentation and deprecation window.

Safety

• Note: Standalone Forge doesn’t include any Grid or other Praxis runtime components. It only carries a few small demo-shaped config fixtures so its tests can verify that real multi-cluster topologies still validate correctly. These can be removed if we don't want to test (tests/fixtures):
  • Parse real multi-cluster demo configurations.
  • Validate cluster, stack, network, and dependency relationships.
  • Resolve relative files and paths correctly.
  • Handle cross-cluster networking.
  • Run from directories outside the repository.
  • Preserve expected CLI behavior without relying on Grid-specific code.
• Cleanup verifies Forge ownership before removing containers or networks.
• Unrelated resources are preserved.
• Secret material, kubeconfigs, certificates, and credentials are not emitted by validation evidence.
• The Grid in-tree Forge implementation remains available as a fallback during migration.