feat!: regroup the parameter surface into concern structs

[jcardozo-eth]

Closes #13.

Changes

The parameter surface regroups into five flat keys (concurrent, runners, runner_defaults, runner_tokens, secret_store_path) and six parameter groups, one hash per concern (configuration_file, runner_account, packages, rootless_docker, runner_service, and standalone with self_update nested inside), declared in a deliberate order that the generated REFERENCE.md and the example node files preserve: the config.toml content first, then the host concerns.

Every default now lives in the module data layer and each group carries a deep-merge lookup rule, so consumer data holds only deviations: a node file setting rootless_docker.manage: true inherits the rest of the group, hierarchy layers can own different subkeys of one group, array subkeys union across layers with a ---prefixed element removing the matching element a lower layer contributed (the knockout_prefix of the deep merge), and a mistyped subkey fails the compile instead of being silently ignored. The class signature is types-only; a resource-style declaration bypasses Hiera merging and must pass complete hashes, as documented.

The apply script now installs on any declared-standalone host (standalone.manage: true), not only with the self-update loop, and enabling standalone.self_update.manage on a host not declared standalone fails at compile time. healthcheck_interval lives on the standalone group.

The data check's advisory no longer calls subkeys under a disabled manage toggle inert: it reports them as not enforced, since the module may still read some of them as shared inputs (the runner account's identity keys are read by every concern regardless of the toggle).

The README, examples/data/, CONTRIBUTING, and REFERENCE.md are reworked to the new surface, and the unreleased CHANGELOG entries are consolidated into one coherent description of it.

Verification

• Full gate green: validate, lint, 112 spec examples, docs-check.
• Deep merge exercised through a real two-layer Hiera hierarchy: a partial consumer hash fills its unset subkeys from the module defaults, a scalar subkey set in the node layer overrides the common layer, array subkeys union across layers with a ---prefixed element removing the matching lower-layer element, and a plain-YAML token store is wrapped Sensitive by the convert_to lookup rule.
• Unknown subkeys (top-level and nested) and the standalone containment check demonstrated failing the compile with the offending key named.
• Mutation-checked, each failing its test when reverted: the containment fail() in manifests/init.pp, the default values in data/common.yaml, the knockout_prefix: '--' entry in the lookup_options, the Struct type rejecting unknown subkeys, and the advisory wording in scripts/check_hiera_data.rb.
• The shipped data check run against pre-restructure consumer keys reports each as failing loud; a subkey under a disabled manage toggle gets the non-failing advisory.