Implement wfctl infra cleanup --tag for full-wfctl conformance gate cleanup

[intel352]

Context

W-7 of the IaC conformance plan (PR #535) introduced the conformance smoke gate. Plan literal §T7.13 specified doctl compute droplet list --tag-name ... | xargs doctl compute droplet delete -f for outer-job cleanup.

Workspace policy forbids doctl (full-wfctl-dogfooding rule). The wfctl infra cleanup --tag <name> subcommand does not yet exist. Smoke job currently logs cleanup intent and falls through to T7.14's hourly leak scrubber.

Requested

Implement wfctl infra cleanup --tag <name> that:

1. Lists provisioned cloud resources matching the given tag across all loaded providers.
2. Deletes them (using each provider's resource-driver Delete path; honors --dry-run flag).
3. Returns non-zero exit on partial failure with structured stdout summary.

Once implemented:

• Update .github/workflows/conformance-smoke.yml:106-118 to replace the stub with wfctl infra cleanup --tag conformance-pr-\${PR_NUMBER}.
• Update docs/conformance-runbook.md "Known follow-ups" section to reflect closure.

Reference

• W-7 PR feat(iac): conformance suite + DO smoke gate (W-7 of 12) #535
• Plan: docs/plans/2026-05-03-iac-conformance-and-replace.md §T7.13