Story 9.1 — Implement built-in catalog of tested infrastructure version combinations

**Epic:** #506 — Infrastructure Version Management

Embed a catalog of validated, opinionated version combinations (CRI-O, kubelet, Helm charts) keyed by `provisioner.cli.version`.

**Acceptance criteria:**
- Catalog is embedded in the binary at build time (not loaded from disk at runtime)
- Each entry is keyed by `provisioner.cli.version` and declares exact versions for: CRI-O, kubelet, MetalLB, Cilium, cert-manager, solo-operator Helm chart
- Catalog is the single source of truth; manifest `host` and `cluster` sections are validated against it