Add rollout sharding, firewall management, and encrypted config

[TsekNet]

converge currently lacks three capabilities needed to replace legacy config management for client fleet management:

1. Rollout sharding: no way to gradually roll out changes to a percentage of the fleet
2. Firewall management: no cross-platform firewall rule primitives (Windows, Linux, macOS)
3. Encrypted config: no way to store secrets in the repo without external dependencies (SOPS, cloud KMS, etc.)

All three are blockers for production adoption at scale.