refactor: zero-based architecture cleanup

[lucarlig]

Summary

• Collapse the internal crates into private logical modules in the single published cf-integration package, with only cf_integration::run exported.
• Embed and atomically materialize runtime assets while keeping report/token-only actions side-effect free.
• Separate infrastructure, live-stack conformance, official conformance, and performance workflow ownership behind one CLI.
• Unify MCP transport behavior, centralize async cleanup, and remove unsupported aliases, historical artifact support, stale Git-fetch fallback, and local JWT generation.
• Add stable quality CI plus native Linux, macOS, and Windows tests. Build and smoke-test all six ARM64/x86-64 release candidates before publishing the crate or tag.
• Provide repeatable protocol/server-era Cartesian conformance runs, strict lane baselines, transactional blessing, partitioned artifacts, and nextest-style colored progress/results.
• Run both MCP conformance directions by default for the external dataplane on protocol 2026-07-28: the official client tests the fixture directly and through the gateways, then the external dataplane client runs tools_call, request-metadata, http-standard-headers, and http-custom-headers against official scenario servers.

Breaking interface cleanup

• Workflow commands accept only --lane; stack commands retain --topology.
• fixture, --client-version, and --spec-version are rejected.
• MCP_VIRTUAL_SERVER_ID, FAST_TIME_IMAGE, and IMAGE_LOCAL are not accepted as inputs. Required Compose adapter variables are derived internally from canonical configuration.
• Conformance metadata requires exact pinned fixture provenance and direction; old caller-managed/historical artifacts are rejected.
• The current control-plane catalog field is only gatewayId; the old snake_case input is rejected.
• Git fetch failures are fatal and never reuse stale local refs.

Validation

• cargo fmt --all --check
• cargo clippy --all-targets -- -D warnings
• cargo test --all-targets: 343 passed
• cargo package --locked: 86 files, 203.6 KiB compressed
• Actionlint
• live external dataplane run: 80 server scenarios plus 4 downstream client scenarios completed; client gate reported 3 PASS and 1 expected custom-header XFAIL
• standalone macOS ARM64 release binary rebuilt and smoke-tested

This work was developed as the layer above PR #7. Since #7 merged before submission, gh-stack correctly based this remaining PR directly on main.