Add public delivery configuration template

[Nickfost]

Closes the implementation portion of #12.

What changed

• records the public-engine/private-configuration architecture decision
• adds the complete public ci-fleet-config-template scaffold under templates/config-repository
• adds a dependency-free JSON validator and safe initializer
• enforces private-repository CI pools, separate deploy hosts, standard Docker CI entrypoints, and approval-gated production
• rejects probable embedded secrets and secret-bearing file paths
• includes a Mermaid architecture graphic and a fictional multi-host example
• adds nine negative regression tests proving unsafe configurations fail closed
• wires the scaffold into the existing GitHub-hosted validation workflow

Why

The standalone template repository should be published only after the exact same payload has passed ci-fleet's own checks. Random Development's eventual private configuration will then be generated from the public artifact everyone else receives.

Validation

• python3 templates/config-repository/scripts/test_policy.py
• templates/config-repository/scripts/validate.sh
• multi-host example validation
• strict initialization of a temporary organization configuration
• existing inert controller/image validation

Remaining dogfood gate

After this PR is green and merged: create the empty public RandomDevelopment/ci-fleet-config-template repository, publish this scaffold there, mark it as a GitHub template, then generate the private RD configuration from it.