feat(benchmarks): add offline progressive Fly transport

[DecisionNerd]

Closes #1036
Progresses #900

Summary

• adds an import-only Fly ProviderTransport with a concrete shell-free, nonce-app-confined flyctl/Machines API boundary
• adds an import-only Pulumi ESC input capsule with one-shot spend authority, secret scrubbing, redacted representations, and isolated HOME/XDG state
• validates exact app/org, Machine, volume, immutable image, metadata, private/no-service shape, and zero-secret inventory before rung execution
• uses result-first canonical artifact retrieval and inventory-driven, bounded teardown recovery
• adds offline CI coverage and documents the remaining live-activation blockers

Safety boundary

This PR makes no provider calls and authorizes no spend. It does not wire progressive-ladder into the operator, workflow, or gate registry; that gate still refuses before opening ESC.

Live activation remains blocked on:

• protected/versioned ESC configuration and short-lived scoped token policy
• immutable qualification image publication
• independently scheduled cleanup or an independently enforced lease/TTL
• separate reviewed spend authorization
• deadline-bounded Machine readiness convergence

Verification

• 27 focused Fly/ESC tests
• 176 benchmark tests
• Ruff lint and format checks
• workflow validation
• 23 gate definitions valid
• independent runtime, security, and test audits clean

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e39007d2-06c9-4471-8bdc-21d548c55cb7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

_{Comment @coderabbitai help to get the list of available commands.}