infra(cx2-5): DNS auth/NetPol substrate, air-gap landing, arm64 ARC runner + tenant landing manifests

- fc-dns: add OnePasswordItem CRD for DNS API keys + NetworkPolicy for Phase 0 auth hardening; bump dns-web image tag
- fc-landing: rewrite landing HTML to remove CDN dependencies (air-gap safe); add preview.html standalone preview
- github-runner: add TOOLCACHE_ARCH to install-ruby-toolcache.sh for arm64 support; add Dockerfile.arm64 for arm64 ARC runner image
- docs/gx10-tenant-landing: per-user Deployment+IngressRoute manifests (andrew/dustin/erik/fit/matt) + CUTOVER-RUNBOOK.md

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/gx10-tenant-landing/fit-ingressroute.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: fit-web
+  namespace: fc-tenant-fit
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`flowerinsider.xyz`) || Host(`www.flowerinsider.xyz`)
+      kind: Rule
+      priority: 100
+      services:
+        - name: fit-web
+          port: 80
+  tls:
+    secretName: cf-origin-flowerinsider-xyz