test(compliance): guard destructive T4 lifecycles

[joshrotenberg]

Summary

Claim issue #147 and implement the deliberately deferred T4 destructive/mutating compliance pass behind explicit, reviewable safety and cost controls.

Closes #147.

Planned work

• Require --ignored, live credentials, pinned resource IDs, and REDIS_CLOUD_ALLOW_DESTRUCTIVE=1; normal and scheduled safe CI must remain unable to enter T4.
• Use unique reserved test names and preflight ownership checks so cleanup cannot target unrelated resources.
• Dry-run billable creates first and require an explicit reviewed cost ceiling before provisioning.
• Implement create → verify → delete lifecycles with unconditional teardown and task polling for supported subscription/database resources.
• Cover destructive database actions and feasible connectivity/Active-Active writes only where dedicated fixtures make the target unambiguous.
• Keep cloud-account lifecycle coverage gated on dedicated disposable provider credentials rather than reusing an arbitrary account integration.
• Fold stable results into the compliance baseline and document skips where the required disposable infrastructure is not configured.
• Validate request safety with mocks before any live destructive execution.

Safety boundary

No live resource creation or deletion is authorized by opening this draft. The currently active Pro test database/subscription shutdown is tracked separately and requires explicit confirmation that permanent deletion with no recovery is intended.