feat: Add Crossplane Composition render pipeline (ADR-014)

[davetashner]

Summary

• Replace envsubst-based template pipeline with crossplane render for build-time Composition expansion
• Claims are expanded into 19 individual managed resource YAMLs per environment
• ConfigHub stores fully-expanded resources for resource-level visibility, diffs, rollback, and policy enforcement
• CI workflow rewritten to render all overlays with matrix strategy
• Demo script updated to reflect the expanded-resource workflow

Evidence

Local render produces 19 resources and passes validation:

=== Rendering Composition for dev-east ===
Step 1: Building Kustomize overlay...
Step 2: Converting Claim to XR...
Step 3: Running crossplane render...
Step 4: Splitting into individual resource files...
  api-handler.yaml (Function)
  api-role.yaml (Role)
  api-role-policy.yaml (RolePolicy)
  bucket.yaml (Bucket)
  bucket-cors.yaml (BucketCorsConfiguration)
  bucket-ownership.yaml (BucketOwnershipControls)
  bucket-policy.yaml (BucketPolicy)
  bucket-public-access.yaml (BucketPublicAccessBlock)
  bucket-website.yaml (BucketWebsiteConfiguration)
  eventbridge-permission.yaml (Permission)
  eventbridge-rule.yaml (Rule)
  eventbridge-target.yaml (Target)
  function-url.yaml (FunctionURL)
  function-url-invoke-permission.yaml (Permission)
  function-url-permission.yaml (Permission)
  snapshot-role.yaml (Role)
  snapshot-role-policy.yaml (RolePolicy)
  snapshot-writer.yaml (Function)
  table.yaml (Table)

=== Render Complete ===
  Resources: 19

PASSED: All policy checks passed

Test plan

• CI workflow triggers on PR (path filter matches infra/claims/**)
• crossplane render step installs and runs in GitHub Actions
• Policy validation passes on rendered output
• ConfigHub preview step shows 19 units for dev-east

🤖 Generated with Claude Code