Bound native container execution and owned cleanup - #17

Native command/probe execution could lose output provenance, continue workspace accounting after cancellation, or leave a container running after a CLI failure. This adds bounded process capture/deadlines and exact attempt-owner/full-ID cleanup, preserving original errors and explicit cleanup uncertainty.

The opt-in read-only workspace policy validates runtime controls, initial workspace contents, mounts and image volumes. Workloads and probes require cached images (--pull never). Writable workspace usage remains a measurement rather than a general hard quota. The existing exported DirectorySize API is unchanged; final runtime accounting uses cancellation-aware measurements and rejects incomplete totals.

Validation:

• Full declared-module-graph go test ./... -race -count=1 and go vet ./... passed on Go1.27.3.
• Full Compute consumer suite passed against this exact local plugin source with its selected core v0.8.8; the plugin's own core v0.6.0 graph also passed.
• Regressions cover omitted/null/empty/writable image volumes, accounting cancellation/partial failure, CLI-error cleanup, foreign-owner refusal and original-error preservation. Four deliberate fix reversions were rejected.
• The baseline Go1.27/gRPC build failure is fixed by the minimum x/net v0.55.0 compatibility update (and its x/sys v0.45.0 requirement).

Filesystem cancellation is cooperative between filesystem calls. CLI fault tests use synthetic process dependencies; this PR does not claim a fresh real-engine transport-failure cleanup exercise. One inherited minor gap remains: injected runner removal output is not post-bounded like inspection output; the default real process runner is bounded.

Doc-reconciliation: clean.

Draft for source review and CI. Merge, tags/releases, registry publication and live rollout remain separate gates.