feat(executor): join existing Linux namespaces

[ZhiXiao-Lin]

Summary

• open and type-check existing UTS, mount, IPC, network, cgroup, PID, user, and time namespace descriptors before any namespace transition
• join non-user namespaces around the target user-namespace capability transition, preserve PID/time next-child semantics, and retain rootfs access after mount-namespace entry
• add schema-v3 native Linux and utility-VM qualification for wrong-type rejection, all namespace joins, running-state proof, donor isolation, and complete cleanup
• align the README with A3S Boot, add a Mermaid architecture diagram, and update roadmap, platform, protocol, and conformance documentation

Mount entries in inherited or joined mount namespaces and rootless ID mapping remain explicitly unsupported.

Validation

• cargo fmt --all -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• Linux x86_64 and aarch64 cross-target Clippy
• RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps
• ShellCheck and actionlint
• Mermaid diagram rendered successfully through Kroki
• privileged Linux arm64 qualification with /dev/kvm absent and present-but-unusable; both schema-v3 namespace reports passed every evidence field
• real Apple Silicon HVF schema-v3 multi-container qualification; all namespace-join, process, endpoint, descriptor, and guest-runtime cleanup evidence passed