Encrypt Murmur control-plane traffic to GPU workers

Replace plaintext HTTP between the Murmur control plane and public ephemeral GPU workers with authenticated, certificate-validated encryption. Current boundary: - Security groups restrict worker port 8080 to the control-plane source address and bearer authentication rejects unauthorized requests. - Audio URLs, worker credentials and optional transcription prompts still traverse the provider network over plaintext HTTP. Acceptance criteria: - Control-to-worker requests use authenticated encryption with certificate or key validation; disabling verification is not acceptable. - Ephemeral key/certificate provisioning does not expose secrets in logs, API errors, cloud-init output or public metadata. - Worker readiness and transcription requests fail closed on identity mismatch. - L4 and P100 profiles pass live transcription and automatic cleanup tests with the encrypted transport. - Credential/certificate rotation and interrupted provisioning cleanup are documented and tested.