refactor(orchestrator): fail closed unconditionally, drop topology opt-out

Remove the empty-key opt-out codex flagged: ControlPlaneProvisioning
no longer lets the orchestrator start without a signing key when a
backend declares an "isolated" topology. Host separation is not the
safety condition — the gateway (and any other caller) must reach the
control-plane listener for /resolve, so an open orchestrator would
still grant them full `cli`. The signing key is now mandatory for
every backend.

Drops the now-purposeless Topology/COLOCATED machinery (no backend
declared a non-default topology) and the contractual
test_orchestrator_key_allows_empty_when_isolated. Updates the PRD's
invariant 4 and lifecycle docstring accordingly. Docs/behaviour only
otherwise.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/prds/prd-new-control-plane-auth-provisioning.md

@@ -45,7 +45,9 @@ key.
      pre-minted `gateway` token it can't rewrite into `cli`;
   3. the host CLI's `cli` token is minted from the same key, so it stays valid
      across co-running backends;
-  4. the control plane never runs open where its data plane shares the host/VM.
+  4. the orchestrator never runs open — the signing key is mandatory, with no
+     topology opt-out (a separate host does not stop a caller from reaching the
+     control-plane listener, so it cannot make open mode safe).
 
 ## Non-goals
 
@@ -72,9 +74,8 @@ signed by one service's key neither carries nor verifies another service's role.
 
 **`ControlPlaneProvisioning`** is the seam the backends call.
 `orchestrator_key()` returns the raw key for the control-plane process
-(fail-closed: it raises rather than hand back an empty key that would run the
-server open where the data plane is co-located). `gateway_token()` mints the
-gateway's token. Each backend applies these through its own transport —
+(fail-closed for every backend: it raises rather than hand back an empty key that
+would run the server open). `gateway_token()` mints the gateway's token. Each backend applies these through its own transport —
 docker/macOS inject env vars, firecracker pushes over SSH — but none re-derives
 *which* key or role.