P1: add apple/container runtime integration

[chimerakang]

Summary

• add the P1 apple/container runtime driver with lifecycle, logs, exec, status, typed errors, arch verification, and per-workload locking
• add hermetic unit tests plus gated MACVZ_INTEGRATION tests against the real container service
• add mvz-bench density/RAM benchmark harness and recorded P1 benchmark results
• wire macvz-kubelet runtime readiness logging and runtime binary config

Validation

• go test ./...
• go vet ./...
• make build
• make bench
• golangci-lint run
• MACVZ_INTEGRATION=1 go test ./pkg/runtime/container -run Integration -count=1 -v

Integration evidence

• container CLI/apiserver version: 1.0.0
• lifecycle integration booted Alpine to Running with IP in ~951ms on the latest run
• logs, exec, stdin, non-zero exit mapping, cancellation, and arm64 image verification passed