feat(executor): create user and time namespaces

[ZhiXiao-Lin]

Summary

• create rootful user namespaces first and install exact UID/GID mappings through a blocking, authenticated parent/init handshake with read-back verification
• create time namespaces, apply normalized monotonic/boottime offsets before the first child, and authenticate user/time/PID namespace identities
• exercise all eight Linux namespace types through native Linux and macOS HVF lifecycle, multi-container, and no-delete cleanup gates
• require native Linux time namespace prerequisites and update the runtime boundary, roadmap, conformance matrix, and platform documentation

Rootless subordinate-ID helpers and namespace joins remain explicitly unsupported.

Validation

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --locked on macOS
• Linux arm64 Docker: all 159 workspace tests passed
• cargo clippy --workspace --all-targets --locked -- -D warnings
• Linux x86_64/aarch64 cross-target Clippy
• Windows MSVC stub Clippy
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps --locked
• ShellCheck, bash -n, and actionlint
• privileged Linux arm64 native smoke: KVM absent/present-unusable, single-container, multi-container, and all three fault-cleanup phases
• real Apple Silicon HVF: agent negotiation, fixed OCI lifecycle, multi-container lifecycle, and after-create/after-start/after-kill cleanup