#39: Require external isolation for high-risk lab workloads

[justsml]

Split from the Wayfinder mega PR #137.

Refs #39

Scope

• Route untrusted-code and malware-analysis workloads to the MicroVM boundary and fail closed when that runtime is unavailable.
• Recreate stopped containers whose externally observed runtime or isolation labels do not match the requested MicroVM boundary before they can start.
• Attest every successful MicroVM start from the Docker daemon using the observed container ID, running state, OCI runtime class, isolation label, and workload class.
• Remove mismatched workloads and sidecars, independently verify removal, and preserve structured cleanup outcomes and the cleanup target when containment cannot be confirmed.
• Refuse to persist dry-run MicroVM plans as running.
• Persist verified and failed attestation facts in durable lab runtime metadata and document the boundary and limitations.
• Persist failed attestation and unresolved cleanup events as redacted canonical Artifacts with requested/observed isolation facts, cleanup outcomes, and trusted project/thread/research-run correlation.
• Keep containment failure authoritative when Artifact persistence is unavailable; verified starts emit no violation Artifact.

Validation

• pnpm exec vitest run --config vitest.integration.config.ts tests/integration/lab-attestation-persistence.test.ts tests/integration/lab-runtime.test.ts tests/integration/project-lab.test.ts (3 files, 64 tests passed)
• pnpm typecheck
• git diff --check
• Parallel security/spec/diff reviews completed for the start-attestation slice; no P1 blocker remained before the Artifact follow-up.

Review notes

This is a bounded start-attestation and canonical failure-evidence slice. It does not close #39. Continuous namespace, mount, privilege, socket, firewall, device, and listener observers and deterministic run-halting gates remain follow-up work.

[justsml]

Council of Dans review: repair/defer. Highest-priority gate: Resolve current-main conflicts and prove real fail-closed isolation plus bounded cleanup against the actual runtime; trusted policy must classify workload risk. Feature flags are not a substitute for authority, evidence-integrity, or durability fixes; use typed modes only where they provide a real rollout boundary.