feat(isolation): add RFC 0012 backend contract

[drew]

Summary

Define RFC 0012's runtime-selectable Isolation Backend contract and its security invariants. This is PR 1 of 2 in the draft stack and introduces no runtime activation. PR #2943 is an unstacked follow-on prototype.

Stack: this PR → codex/1737-rfc12-supervisor-primitives. Unstacked follow-on: #2943.

Review-only prototype: The original code author is @jganoff, and the original implementation source is jganoff/OpenShell:jganoff/rfc-0012-impl. This reconstructed stack is for reviewing and prototyping RFC 0012; we do not intend to merge these PRs. The stack is rebased onto current main and integrated with the current canonical process and networking architecture.

Related Issue

Part of #1737. The final PR in this stack closes the issue.

Changes

• Add the RFC 0012 proposal, codebase grounding, and topology matrix.
• Add the openshell-isolation crate with consuming Bound → Ready → Running lifecycle states.
• Add exact descriptor/backend/version resolution with no fallback.
• Add placement-neutral process, exec, terminal, port-forward, and network-mediation contracts.
• Add contract conformance and fail-closed behavior tests.

Testing

• cargo test -p openshell-isolation — 21 passed
• Integrated stack compiles across sandbox, supervisor, and affected drivers
• Privileged/socket tests require an environment that permits namespace and socket creation

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (RFC and architecture inventory)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.