terraform+nix: Hetzner orchestrator server (cpx11, nixos-infect, cc-ci-orchestrator-hetzner flake host)

Adds terraform/ to provision a Hetzner cpx11 (2 vCPU / 2 GB dedicated AMD / 40 GB NVMe)
for the loops runtime, and a flake + NixOS host config to converge it — replacing the slow
b1 Incus VM. Mirrors the cc-ci server terraform (same nixos-infect pin, same pattern).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nix/hosts/cc-ci-orchestrator-hetzner/hardware.nix

@@ -0,0 +1,21 @@
+# PLACEHOLDER — replace with the output of:
+#   ssh root@<server_ipv4> 'cat /etc/nixos/hardware-configuration.nix'
+# after nixos-infect completes. See terraform/README.md Stage 2a.
+#
+# A typical Hetzner cpx11 nixos-infect hardware.nix looks like:
+#
+#   { config, lib, pkgs, modulesPath, ... }: {
+#     imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+#     boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+#     boot.initrd.kernelModules = [ ];
+#     boot.kernelModules = [ "kvm-amd" ];
+#     boot.extraModulePackages = [ ];
+#     fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+#     boot.loader.grub.enable = true;
+#     boot.loader.grub.device = "/dev/sda";
+#     swapDevices = [ ];
+#     nixpkgs.hostPlatform = "x86_64-linux";
+#   }
+#
+# Do not commit this placeholder — replace it with the real hardware-configuration.nix.
+throw "Replace this placeholder with the real nixos-infect hardware-configuration.nix"