Establish generalized migration control plane foundation

What changed

• Introduces shared TypeScript control-plane models for snapshots, provenance, per-resource fidelity, dependency-ordered plans, risk, and approval boundaries.
• Adds strict runtime validation, deterministic content IDs, versioned private artifact storage, reports, and a truthful capability registry.
• Places the existing IP planner behind a staged Vercel Firewall compiler boundary.
• Adds an offline Cloudflare Custom Rulesets semantic vertical with fail-closed expression parsing and explicit exact, approximate, manual, or unsupported mappings.
• Adds plan-ip, plan-cloudflare, validate, report, and support CLI commands.
• Documents architecture, roadmap, support boundaries, and progress in root AGENTS.md and the architecture guide.
• Blocks the legacy Fastly blacklist guidance that inverted blacklist intent.

Why

The previous Bash workflow flattened provider data into IP strings and could not preserve actions, conditions, order, scope, or provenance. This establishes an inspectable migration control plane in which unsupported semantics remain visible and Firewall changes are planned as staged operations with a human publish boundary.

Current support boundary

Cloudflare Rulesets are supported from an offline API response for a documented expression/action subset. Native authenticated discovery is pending. AWS, Akamai, and Fastly remain manual-input paths, as reported by vercel-migrate support.

Validation

• npm run typecheck
• npm test — 531 tests
• npm run build
• bash -n scripts/exports/fastly-export.sh
• scripts/tests/allowlist-decomposition/run-tests.sh — 22/22
• End-to-end CLI smoke tests for plan, validate, report, and Cloudflare translation
• git diff --check