feat(provision): Phase-0 throwaway test VM via vendored @olsitec/pulumi-hetzner

- Vendor hetzner module (Stage-1, trimmed to @pulumi/hcloud+js-yaml; dropped unused
  types.ts + bcrypt/axios/tls/vault deps). GOTCHA documented: cloud-init moves SSH
  to port 222.
- provision/: isolated stack (platformName foundation-test, no collision with
  olsicloud4-*) — one cx23 in nbg1-dc3 + firewall (222/80/443/2222) + Docker cloud-init.
  Dedicated throwaway ed25519 key (operator id_rsa already registered → uniqueness_error).
- Provisioned + verified: foundation-test @ 91.98.117.152, Docker 29.6.1, docker-over-SSH OK.

Token via ENV (pass), never committed; provision/state gitignored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/pulumi-hetzner/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "@olsitec/pulumi-hetzner",
+  "version": "1.0.0",
+  "private": true,
+  "main": "index.ts",
+  "description": "Vendored Hetzner Cloud provisioning module (Stage-1 vendor; see VENDORED.md). Trimmed to the deps HetznerDeployment actually uses.",
+  "dependencies": {
+    "@pulumi/hcloud": "^1.21.1",
+    "@pulumi/pulumi": "^3.138.0",
+    "js-yaml": "^4.1.0"
+  },
+  "devDependencies": {
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^18",
+    "typescript": "^5.0.0"
+  }
+}