Run from a workstation

.local/ (gitignored): config.json from config.example.json; scaleway.env with SCW_ACCESS_KEY, SCW_SECRET_KEY, SCW_DEFAULT_ORGANIZATION_ID; gitlab.env with GITLAB_TOKEN.
scripts/agent-binary.sh builds the VM agent into .local/ciburst-vm-agent.
cargo run -p ciburst -- plan --config .local/config.json, then apply. Details: docs/RUNBOOK.md, Developer setup.

Without a cloud: cargo run -p ciburst -- apply --config test/config.fake.json --skip-gitlab runs against in-memory fakes.

Command	Effect
`plan`	every step `apply` would run
`apply`	checks that the VM runner can start a VM, creates or updates everything, then starts the jobs that wait
`status`	dispatcher URL, live runs of the VM runner and of each project's lanes, the members, the last 20 runs; with a GitLab token each webhook's state and its last 20 deliveries
`check [--ref <ref>] [--suggest]`	lints each project's pipeline against its own lanes and `ignoreJobs` and exits 1 on a problem; `--suggest` prints lanes for the Docker-free jobs and exits 0, or 1 when a pipeline cannot be read
`rotate runner\|hook\|key\|cache\|vm`	replaces that secret and redeploys
`invite <project>`	a join code for another project
`destroy --yes <name>`	removes every resource of the deployment

Global options: --ci (pipeline mode), --config <path>, --local <dir>, --agent <path>, --skip-gitlab. join and leave run only with --ci, in a member's pipeline.