feat(microvm): add Terraform compute provider

.github/workflows/terraform.yml

@@ -87,6 +87,8 @@ jobs:
             "multi-runner",
             "compute-providers/aws/ec2",
             "compute-providers/aws/ec2/trust-policy",
+            "compute-providers/aws/microvm",
+            "compute-providers/aws/microvm/trust-policy",
             "runner-binaries-syncer",
             "orchestration-providers/webhook",
             "orchestration-providers/webhook/job-retry",
@@ -231,6 +233,8 @@ jobs:
           - modules/runner-config/ssm-housekeeper
           - modules/compute-providers/aws/ec2
           - modules/compute-providers/aws/ec2/trust-policy
+          - modules/compute-providers/aws/microvm
+          - modules/compute-providers/aws/microvm/trust-policy
     defaults:
       run:
         working-directory: ${{ matrix.module }}

docs/index.md

@@ -117,7 +117,7 @@ The shared webhook, runner configurations, SSM housekeepers, runner-binary synce
 
 Global `ssm.paths.root` is the base for shared and runner-configuration-owned parameters. The shared GitHub App and webhook paths append `ssm.paths.app` (default `app`) and `ssm.paths.webhook` (default `webhook`), while normalization appends the runner-configuration key only for configuration-owned paths. The default derived base is `/github-action-runners/${prefix}`, and runner token/config segments default to `runners/tokens` and `runners/config`. Global `ssm.kms_key_id` is an optional ARN-valued scalar that encrypts the shared GitHub App parameters, configures the webhook, and adds matching decrypt permissions to every runner configuration; it does not select encryption for runtime-created runner parameters. Webhook-provider leaves conditionally omit their KMS statements when this value is null, while apply-time-unknown key ARNs remain valid during planning. Nested metrics retain the established defaults: disabled, using the `GitHub Runners` namespace, with the rate-limit, job-retry, Spot-termination, and Spot-warning switches enabled. Spot metrics are global termination-watcher settings rather than per-configuration overrides.
 
-Each runner configuration selects two independent typed providers: one `orchestration_provider` provider for demand control and one namespaced `compute_provider` for runner capacity. `orchestration_provider.webhook` is the sole supported orchestration provider today. The global `experimental.compute_provider` block owns shared v2 provider defaults plus the runner-binary, termination-watcher, and AMI-housekeeper singleton configuration, but it does not select a provider. Today the only selectable compute leaf is `compute_provider.aws.ec2`. The wrapped provider objects reach runner-config, which validates each exact-one selection and dispatches the matching root-level provider module. `orchestration-providers/webhook` owns scale-up, scale-down, scheduled pool, job retry, and their webhook-specific defaults and tag layering; runner-config retains common SSM housekeeping plus the common runner role and attachments. The EC2 implementation lives under `compute-providers/aws/ec2`, supplies EC2-specific policy requirements, and owns the instance profile, launch template, bootstrap resources, and runner log groups. Runner-config dispatches it at `module.compute_aws_ec2[0]` and exposes its resources under the matching nested output path `provider.aws.ec2` (for multi-runner, `runners_map_v2["<runner_config>"].provider.aws.ec2`). Declarative moved blocks preserve state created at the earlier experimental `module.compute_ec2[0]` and `module.compute_ec2_trust_policy[0]` child addresses when upgrading to the namespaced labels. They do not migrate stable-v1 `module.runners` state to v2, and they cannot rewrite configuration references from `provider.ec2` to `provider.aws.ec2`. These modules are internal experimental implementation boundaries, not standalone public entry points. Later releases can add mutually exclusive namespace and provider siblings without changing the common contract. See the [experimental orchestration- and compute-provider refactor](modules/internal/compute-provider-refactor.md) and [multi-runner v2 migration roadmap](modules/public/multi-runner.md#multi-runner-v2-migration-roadmap). EC2 is the only active Terraform-managed provider; microVM, CodeBuild, and other provider modules are future work.
+Each runner configuration selects two independent typed providers: one `orchestration_provider` provider for demand control and one namespaced `compute_provider` for runner capacity. `orchestration_provider.webhook` is the sole supported orchestration provider today. The global `experimental.compute_provider` block owns shared v2 provider defaults plus the EC2 runner-binary, termination-watcher, and AMI-housekeeper singleton configuration, but it does not select a provider. The selectable compute leaves are `compute_provider.aws.ec2` and `compute_provider.aws.microvm`; runner-config validates the exact-one selection and dispatches the matching root-level provider module. `orchestration-providers/webhook` owns scale-up, scale-down, scheduled pool, job retry, and their webhook-specific defaults and tag layering; runner-config retains common SSM housekeeping plus the common runner role and attachments. The EC2 implementation lives under `compute-providers/aws/ec2`, supplies EC2-specific policy requirements, and owns the instance profile, launch template, bootstrap resources, and runner log groups. The MicroVM implementation lives under `compute-providers/aws/microvm`, supplies Lambda MicroVM control-plane permissions and runtime environment, derives lane-scoped control-plane metadata under the persistent SSM config path, and uses the resolved common runner role as its execution role. That role can read only the non-secret `*.tags` records required by image services, not the ownership and cleanup records. Runner-config dispatches them at `module.compute_aws_ec2[0]` and `module.compute_aws_microvm[0]`, preserves the runtime provider types `ec2` and `microvm`, and exposes their resources under the matching `provider.aws.ec2` and `provider.aws.microvm` output paths. Declarative moved blocks preserve existing EC2 state created at the earlier experimental `module.compute_ec2[0]` and `module.compute_ec2_trust_policy[0]` child addresses when upgrading to the namespaced labels. They do not migrate stable-v1 `module.runners` state to v2, and they cannot rewrite configuration references from `provider.ec2` to `provider.aws.ec2`. MicroVM was introduced directly at its namespaced labels. These modules are internal experimental implementation boundaries, not standalone public entry points. Later releases can add mutually exclusive namespace and provider siblings without changing the common contract. See the [experimental orchestration- and compute-provider refactor](modules/internal/compute-provider-refactor.md) and [multi-runner v2 migration roadmap](modules/public/multi-runner.md#multi-runner-v2-migration-roadmap).
 
 Both modules are built on top of the same base modules. When using the multi-runner module you can deploy different runners with only one deployment.