Define the OOB control port seam and add the Redfish driver

Part of #1814

## Problem

A BYO host is reached two ways: in-band over SSH, and out-of-band through its service processor.
The OOB path is what makes the provider viable — it is how a wedged kernel gets power-cycled and
how the console is read when the OS is gone. KDIVE has no abstraction for it.

Three service processors must sit behind one seam (Redfish and IPMI on x86, the HMC on a PowerVM
LPAR), and their models differ enough that the port shape is a real design commitment: a BMC is
per-host, while the HMC is a managed-system-plus-partition broker fronting many LPARs.

This entry defines the port and ships **Redfish** as the first driver — the modern standard, and
the one the blocking x86 live proof depends on.

## Evidence

- `src/kdive/providers/ports/lifecycle.py:251` — `Controller.power()` is a required port; something
must answer it for a machine KDIVE cannot reach through a hypervisor.
- `src/kdive/providers/core/runtime.py:135` — `ProviderRuntime`, the typed seam this plugs into
(ADR-0063).
- ADR-0012 / ADR-0027 — the register-before-return `SecretBackend` contract credentials flow
through. **Note the difference from ADR-0077:** remote-libvirt materializes x509 files to a
private pkipath and deletes them in a `finally`. Redfish/IPMI/HMC credentials are
username/password, so the control is *redaction*, not on-disk lifetime — a password can surface
in a console transcript in a way a TLS key never does.
- `src/kdive/domain/errors.py` — `ErrorCategory`; pick the most specific existing value, never
invent a string.
- #1808 documents that wrapped HMC drivers hide capability (MAAS's raises `NotImplementedError`
for reset; Beaker's `lpar` rejects `interrupt`) — a reason to drive these interfaces directly.

## Expected outcome

- A typed OOB driver protocol under `src/kdive/providers/byo_host/oob/`, selected per host from the
`[byo_host.oob]` block, covering at minimum: power on/off/reset, power state query, and serial
console attach.
- A Redfish implementation with explicit API-version handling and fail-closed behavior — an
unreachable endpoint or a rejected credential raises a specific `ErrorCategory`, never a silent
fall back to the in-band path.
- Credentials resolved at the worker boundary and registered for redaction for the op's lifetime;
only `(present, source-ref)` persists.
- Any deadline the driver exposes to an agent states all five parts of the limit contract (unit,
reference clock, scope, consequence, recovery) per the cross-cutting invariant.
- Unit/contract tests against a mock Redfish endpoint; no live BMC required to merge.

Blocked by #1815

Start with src/kdive/providers/ports/lifecycle.py:251 and src/kdive/providers/core/runtime.py:135, then review src/kdive/domain/errors.py and the referenced ADR contracts. Define the OOB protocol under src/kdive/providers/byo_host/oob/ and select it from [byo_host.oob]. Done means a fail-closed Redfish driver with credential redaction and mock-endpoint unit/contract tests covering the required operations.

Written by the indexing model from the issue text.