Qualify suspended launcher resource policy

[dovvnloading]

Summary

• extend the disposable AppContainer child runner with bounded Job Object CPU-time, memory, active-process, kill-on-close, and accounting policy
• add suspended native-launcher qualification using fixed indstr.exe only
• verify policy is applied before resume and breakaway flags are absent
• integrate the nested policy evidence into the sandbox report with explicit worker/broker blockers
• document the native launcher ADR and add regression tests

Verification

• python -m pytest -q (219 passed, 1 skipped)
• native launcher policy subcheck passed on Windows; strict overall status remains blocked as designed
• AppContainer isolation and cancellation corpora passed
• compileall, Ruff, contract generation, diff check, and production-route cross-check passed

The unrelated working-tree edit to Cortex.pyproj is intentionally not included. The signed worker package and broker PID/token binding remain unavailable, so no provider launch is authorized.