feat: add runtime execution contracts

[intel352]

Summary

• add host-independent runtime execution request/result contracts to compute-core
• add service runtime result, SLO evidence, and service status evidence contracts
• validate result timing, preview size, resource limits, and canonical evidence hashes

TDD

• RED: GOWORK=off go test ./protocol -run 'RuntimeExecutionRequest|RuntimeExecutionResult|RuntimeServiceResult' -count=1 failed on undefined runtime execution contracts
• RED: GOWORK=off go test ./protocol -run 'RuntimeServiceResultValidatesStatusEvidenceHashes' -count=1 failed because invalid status evidence hashes were accepted
• GREEN: focused protocol runtime execution/service tests pass

Verification

• GOWORK=off go vet ./...
• GOWORK=off go test ./... -count=1
• git diff --check

Adversarial review

• Kept leases, tasks, workspace paths, mounts, network callbacks, and supervisor concerns out of compute-core
• Checked secret-flow risk: Env is already-resolved runtime environment; secret resolution and authorization stay host-owned
• Fixed validation gap for service status evidence hashes before PR