M6 epic: Template, clone, and snapshot operations

[Andreas-Froyland]

Tracking issue. Dependency and status checklists only — implementation stays in narrow linked issues.

Outcome

Template, clone, snapshot, revert, and delete operations are available only after idempotency and destructive-operation review.

Supersedes

Replaces the "VM reset/clone/snapshot" and "golden-image / template workflow" scope items of #3.

Depends on

• M6 lifecycle/task operations
• FM-106 — authorization port and permission catalog (M1)

Scope checklist

• Template and clone workflow with idempotency classification
• Snapshot, revert, and delete behind an explicit destructive-operation review and permission
• Compensation and reconciliation when a clone or snapshot fails midway
• Recorded/simulated API tests plus a dedicated real-cluster suite

Constrained by

• docs/PLAN.md — M6; ADR-0008
• Lifecycle and task operations land before destructive ones

Non-goals

• A backup UI
• Automatic cleanup policy; that belongs to the M7 Lab lease epics