docs(hetzner): add seven-basin acquisition runbook

[CooperBigFoot]

Outcome

Adds the human-operated, acquisition-only Hetzner runbook for campaign tdx-m5-seven-acquire and links it from the Hetzner README. The document freezes the seven absent basins plus control 7020000010, retain-all sizing, bounded acquisition ceiling, concurrency, cost/time gates, evidence preservation, and exact-name default teardown. No campaign or external operation was executed.

ENVIRONMENT HAZARD: GDAL must be installed and discoverable via gdal-config.

version_policy is NONE: NO version bump, NO tag.

Exhaustive write set

• scripts/hetzner/RUNBOOK-tdx-hydro-seven-basin-acquisition.md: new runbook.
• scripts/hetzner/README.md: one prominent acquisition-only index link.

The exact write-set diff passed. The runner, provisioner, bootstrapper, launcher, teardown script, repository contract, adapters, tests, fixtures, schemas, specification, decision records, versions, and changelog are unchanged. pr-body.md is untracked and excluded from the commit.

Command-surface audit

• tdx-hydro-campaign.sh init: usage 59-74, option dispatch 4973-5024, bounded validation 5104-5112, retention/sizing 5168-5211, immutable comparisons 2780-2804.
• tdx-hydro-campaign.sh acquire: usage 59-74, option dispatch 4973-5024, bounded conversion 2928-3004, product behavior 4671-4718, low-concurrency dispatch 4762-4792.
• tdx-hydro-campaign.sh status and recover: usage 59-74 and dispatch at the pinned runner.
• provision.sh: usage 14-27, parser 323-375.
• bootstrap.sh: usage 16-20.
• launch.sh: usage 14-25; every start/status/tail form follows that grammar.
• teardown.sh: usage 14-22, parser and exact-name default teardown 222-241,247-330.

All quoted runner diagnostics were checked byte-for-byte against 266df3755754a679c60e5f2c3c8e2c8e8db4b663. Executable blocks contain no runner subcommand outside init, status, recover, and acquire; no adapter, AWS, S3 URI, compilation runner command, publication command, wildcard mutation, label mutation, prefix mutation, or teardown retention flag. Shellcheck was unavailable, so the ordered Bash fences were concatenated and passed bash -n; no suppression was added.

Codex-plus-critic review

Five review rounds were completed. Early findings covered runner evidence field names, selection JSON shape, detached workload completion, live cost/time enforcement, secret handling, salvage-before-teardown ordering, teardown failure propagation, terminal outcome assertions, report requirements, stale evidence controls, hard-ceiling races, refreshed price arithmetic, and the preservation/teardown reserve. Every finding was resolved.

Final Codex review: no blocking issues. It confirmed bounded early-ceiling salvage, remaining-to-deadline ordinary salvage, exact-session stop before preservation, actual-plus-remaining gross-cost projection, the 7.67-hour preservation/teardown reserve, exact pinned argv and diagnostics, frozen values, secret boundary, section ordering, README scope, and the two-file write set.

Final critic review: no blocking issues. It independently confirmed static syntax, diff cleanliness, exact write set, frozen values, command acceptance, failure paths, evidence validation, reversibility, teardown convergence, and the one-link-only README change.

Acceptance and gate results

• File existence: PASS.
• git diff --check: PASS.
• Exact tracked write-set comparison: PASS.
• Not-touched scope diff: PASS.
• /bin/bash scripts/hetzner/test-tdx-hydro-campaign.sh: PASS, 120 cases completed, 1 shellcheck-unavailable skip.
• Ordered Bash-fence bash -n: PASS.
• cargo fmt --check: PASS.
• cargo clippy --workspace --all-targets -- -D warnings: PASS.
• cargo check --workspace --all-targets: PASS.
• cargo test --workspace: PASS (115 library, 28 CLI library, 9 conformance, 4 integration, and 1 struct-stat test passed; doc tests passed).
• cargo build --workspace: PASS.

No adapter Python suite and no unittest discover command was run.