Draft: ADR: a rig is one unit over cloud-neutral provider primitives

Records ADR-0006, the principle the provider MRs build on: a rig is one unit with its own boundary, reached through cloud-neutral verbs, with no public ingress by default.

Why now: the engine calls gcloud at 119 sites, and ensure_firewall creates two project-wide rules (allow-ssh-4252, allow-http-https) open to 0.0.0.0/0 that nothing deletes.

Sequence:

1. Per-rig ingress on GCE, the security fix. New rigs stop creating the pair.
2. One ssh transport through the provider tunnel, which drops public 4252.
3. Lifecycle lib, providers/gce.sh and fake, with gce/ renamed sim/.
4. providers/aws.sh with a first AWS omnibus rig.
5. README and project description for two clouds.
6. Multi-node shapes, Geo and Kubernetes, as rig specs.
7. Delete the project-wide pair, announced, once every live rig is on per-rig ingress. unit_list across owners names those that predate boundary.