feat: render external local-root groups separately

[scarmuega]

Why

Reciprocal peering with another operator's relay (Blink Labs) needs its own hot, non-advertised local-root group. That way the cross-provider edge can be added or removed without touching the internal b01–b04 fleet mesh. Today the module renders every topology.local_roots entry into one group with valency = count, so an external endpoint would merge into the fleet group.

Change

• add optional topology.external_local_root_groups = [{ access_points = [{ address, port }] }];
• render each external group after the fleet group as advertise: false, trustable: false, valency = length(access_points);
• external groups also opt the instance into a custom topology ConfigMap, but they do not create a nodes-<salt> peer Service, which stays scoped to local_roots;
• document the input in both READMEs.

Compatibility

For an instance with only local_roots, and for the baseline topology, the rendered topology.json is byte-identical to 0245c40. I checked this with terraform console on the b01 mesh input. Bumping the pin without using the new input should therefore produce no ConfigMap diff.

Verification

• terraform fmt -check on the changed files (the unformatted crds/, feature/, and relay/ files are unchanged from main)
• terraform -chdir=bootstrap validate
• terraform -chdir=bootstrap test: 5 passed, including two new runs covering the separate group and an external-group-only instance

🤖 Generated with Claude Code