feat: add Render deployment blueprint

[franciscojavierarceo]

Summary

• add a schema-validated Render Blueprint for a network-isolated private gateway and private managed PostgreSQL
• prompt for inference configuration without committing secrets or resetting operator readiness policy on Blueprint sync
• forward the configured upstream bearer credential from /ready and lock Render-specific invariants in tests
• document authenticated-edge, persistence, redeploy, streaming, and production guidance

This is the unclaimed Render deployment slice of #102 and refs #109.

Merge dependency: #142 must land first because main still uses SQLite-style query placeholders in persistence paths. Keep this PR draft until it is rebased on that PostgreSQL fix and the live Render persistence smoke test is run.

Test Plan

• cargo fmt -- --check
• cargo clippy --all-targets -- -D warnings
• cargo test
• SKIP=no-commit-to-branch uvx pre-commit run --all-files
• uv run --with-requirements docs/requirements.txt mkdocs build
• Render Blueprint validation against the vendored official schema
• read-only Claude review and gstack pre-landing review

Strict MkDocs remains blocked by the pre-existing broken ../../ROADMAP.md link in docs/design/claude-code-integration.md; the non-strict docs build passes.