feat(isolation): add RFC 0012 backend contract - #2941

Summary

Define RFC 0012's runtime-selectable Isolation Backend contract and its security invariants. This is PR 1 of 2 in the draft stack and introduces no runtime activation. PR #2943 is an unstacked follow-on prototype.

Stack: this PR → codex/1737-rfc12-supervisor-primitives. Unstacked follow-on: #2943.

Review-only prototype: The original code author is @jganoff, and the original implementation source is jganoff/OpenShell:jganoff/rfc-0012-impl. This reconstructed stack is for reviewing and prototyping RFC 0012; we do not intend to merge these PRs. The stack is rebased onto current main and integrated with the current canonical process and networking architecture.

Related Issue

Part of #1737. The final PR in this stack closes the issue.

Changes

• Add the RFC 0012 proposal, codebase grounding, and topology matrix.
• Add the openshell-isolation crate with consuming Bound → Ready → Running lifecycle states.
• Add exact descriptor/backend/version resolution with no fallback.
• Add placement-neutral process, exec, terminal, port-forward, and network-mediation contracts.
• Add contract conformance and fail-closed behavior tests.

Testing

• cargo test -p openshell-isolation — 21 passed
• Integrated stack compiles across sandbox, supervisor, and affected drivers
• Privileged/socket tests require an environment that permits namespace and socket creation

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (RFC and architecture inventory)