feat: Cl/ci3.3

[charlielye]

CI3 introduction.

This is a majority step towards the vision of CI3, still namely missing merge queue.

New features:

• Grinding flakes in master. We run all tests on 5 separate runners to report on flakes at the source.
• External contributors can now have CI run just by approving their PR.
• Ability to debug CI entirely from commandline from any machine. Get dropped into a productive shell right after the CI failure by doing ./ci.sh ec2 while your PR is a draft (note: do not do this if pushing to a non-draft PR).
• Add tests to CI by adding tests to bootstrap. Target a rich environment with no differences from running inside the dev container.
• Releases that are fully dry-runnable and deployable from a single command. See above hackmd for details.
• Recovery from spot eviction (finally implemented correctly).

Some remaining items are tracked here.
#10775