feat(bottle): opt-in gVisor runtime per bottle

Bottles can now set "runtime": "runsc" to launch the agent container
under gVisor instead of runc, adding a userspace syscall barrier
between the agent and the host kernel. Default is runc (Docker
default). Pipelock stays on the default runtime per the research doc's
minimum-diff prescription.

The launcher verifies runsc is registered with the daemon before
launch, surfaces the runtime in the preflight plan, and dies with an
install pointer (and a macOS-not-supported note) when runsc is
requested but unavailable.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_dry_run_plan.py

@@ -48,6 +48,7 @@ class TestDryRunPlan(unittest.TestCase):
             # 7 baked defaults + 1 bottle entry = 8.
             self.assertRegex(out, r"8 hosts allowed", "preflight: bottle entry counted")
             self.assertIn("api.anthropic.com", out, "preflight: baked default shown")
+            self.assertRegex(out, r"runtime\s*:\s*runc", "preflight: default runtime shown")
             self.assertIn("dry-run requested", out, "dry-run banner present")
             self.assertNotIn("/dev/tty", out, "dry-run exited before tty prompt")