feat(hetzner): add opt-in bounded acquisition

[CooperBigFoot]

Summary

• add direct-acquire-only --product-attempt-ceiling with exact canonical signed-64-bit parsing and bounded parallelism
• add schema-version-5 basin state, cumulative per-product retry loops, durable exhaustion, fixed-ceiling reruns, and status visibility
• preserve schema-version-3/4, unbounded acquire, pipeline, calibration, selection, report, and reclaim behavior
• fence pipeline and calibration from bounded state before campaign work

Validation

• /bin/bash scripts/hetzner/test-tdx-hydro-campaign.sh - passed all 120 cases, with shellcheck unavailable as the sole recorded skip
• cargo fmt --check - passed
• cargo clippy --workspace --all-targets -- -D warnings - passed
• cargo check --workspace --all-targets - passed
• cargo test --workspace - passed
• cargo build --workspace - passed

The compatibility controls loaded the complete schema-version-3, schema-version-4,
and campaign-schema-version-2 fixtures without mutation before converting only
the selected basin. The mutation children each reached their named assertion as
the first and only harness error: schema-version-3 compatibility status,
schema-version-4 compatibility status, and the legacy two-dispatch pipeline
regression.

The shell-safety review covered Bash 3.2 parsing, quoting and array expansion,
trap and worker ownership, arithmetic limits, atomic temporary paths, exact JSON
keys, safe partial cleanup, and set -Eeuo pipefail error paths. Shellcheck was
not installed. The implementation and critic diff reviews have no unresolved
correctness, schema, compatibility, self-sufficiency, or shell-safety findings.

External effects

All acquisition cases used local fixtures and poison commands. No server was
provisioned, NGA was not contacted, and no AWS, S3, SSH, hcloud, publication,
adapter, HFX compile, assembly, reclaim, or input-deletion action was performed
by the bounded path.