feat(runners): support Lambda MicroVM compute lanes

[edersonbrilhante]

Description

• Support mixed compute_provider.aws.ec2 and compute_provider.aws.microvm lanes while keeping EC2-only AMI, bootstrap, lifecycle-hook, tagging, and IAM helpers scoped to EC2.
• Use the microvm-multi-runner-terraform upstream contract, provider-managed MicroVM runtime log groups, and caller-supplied control-plane/webhook artifacts built from the same upstream branch.
• Pass plan-known provider selections and EC2 runner-binary targets derived from raw runner specs so apply-time values cannot determine module addresses.
• Keep Forge-managed IAM policy ARNs plan-known and avoid duplicating the apply-time AppRegistry tag map inside the typed EC2 provider leaf; shared tags still flow through the common runner tags and provider-specific tags retain precedence.
• Expose provider-neutral and MicroVM-specific runner outputs while preserving existing EC2 output contracts and state addresses.

This draft is stacked on #656 and depends on github-aws-runners/terraform-aws-github-runner#5260. Validation used upstream commit d5d9856993f8fc168244ecc17d7e3ef88327eb01.

Type of Change

• Feature
• Bug Fix
• Documentation
• Refactor
• Other: ___________

Testing

• tofu test in modules/platform/ec2_deployment: 7 passed, 0 failed
• Interface/source tests in modules/platform/forge_runners: 2 passed, 0 failed
• Interface/source tests in modules/platform/forge_runners/github_global_lock: 2 passed, 0 failed
• tofu validate passed in all three changed module roots
• Exact SREA prod/eu-west-1 experimental Terragrunt plan: Plan: 246 to add, 0 to change, 0 to destroy; no unknown count or for_each errors
• Full commit hook suite passed, including formatting, TFLint, Terraform validation, Gitleaks, Bandit, pip-audit, and Ansible lint