Add pVisor runtime and Capture access control

[reiase]

Summary

• introduce persisting-pvisor as the Portable Agent Execution Runtime for one Run
• add shared Run, Attempt, capability, checkpoint, event, model-call, and network-access contracts in persisting-proto
• move Capture network policy decisions behind pVisor's injectable AccessController
• authorize resolved LLM calls through pVisor before sending them upstream
• preserve Capture as the HTTP/SSE protocol and trajectory data plane

Motivation

This establishes the first incremental boundary between Capture and pVisor.
Capture continues to handle mature protocol conversion, streaming, forwarding,
and trajectory extraction, while pVisor becomes the authority for model and
network access decisions associated with an Agent Run.

Impact

Existing Capture public, no-network, and allowlist behavior remains
available through the default policy controller. Runtime-aware integrations can
inject a different controller through serve_with_runtime_control. Network and
model requests carry Run, Storyline, and Call identity where available.

The initial host-process executor is explicitly a compatibility executor: it
does not claim filesystem, syscall, checkpoint, migration, or ambient-network
isolation.

Validation

• cargo test -p persisting-proto — 5 passed
• cargo test -p persisting-pvisor — 6 passed
• cargo test -p persisting-capture --lib proxy:: — 53 passed
• cargo test -p persisting-capture --test network_policy_http — 9 passed
• cargo clippy -p persisting-proto -p persisting-pvisor --all-targets -- -D warnings
• cargo check --workspace