feat(isolation): add RFC 0012 backend contract

[drew]

Summary

Define RFC 0012's runtime-selectable Isolation Backend contract and its security invariants. This is PR 1 of 6 in the stack and introduces the shared interface without activating a backend.

Stack: this PR → #2942 → #3151 → #2945 → #2965 → #3144.

The contract has one boundary entry operation, attach. A trusted TopologyDescriptor identifies or prepares the isolation resource, while the compute driver retains durable provisioning, deletion, and reconciliation ownership.

Related Issue

Part of #1737. The issue does not currently carry state:accepted or roadmap placement; this implementation proceeds under direct maintainer instruction without changing those labels.

Changes

• Add RFC 0012, codebase grounding, and the backend topology matrix.
• Add the single openshell-isolation-interface crate with consuming Bound → Ready → Running lifecycle states.
• Require exact descriptor/backend/version resolution with no fallback.
• Define placement-neutral process, exec, PTY, signal, wait, loopback forwarding, mediated network, and DNS contracts.
• Carry trusted binary identity and backend-provided host-gateway dial targets without changing policy-visible hostnames.
• Distinguish unsupported operations from transient unavailability and strictly validate SHA-256 identity digests.
• Add conformance and fail-closed contract tests; backend implementations remain in their existing driver crates.

Testing

• cargo test -p openshell-isolation-interface — 22 passed
• mise run pre-commit

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• RFC, architecture grounding, and agent crate inventory are updated

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

Label test:e2e applied for a5dc6db. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.