feat: add runtime adapter contract

[intel352]

Summary

• add host-independent runtime adapter declaration contracts to compute-core
• add adapter kind and workspace policy enums for future runtime plugins
• validate runtime descriptor identity, adapter capability, service workload alignment, residue policy, and conformance declarations

TDD

• RED: GOWORK=off go test ./protocol -run 'RuntimeAdapterContract' -count=1 failed on undefined adapter contract symbols
• RED: GOWORK=off go test ./protocol -run 'RuntimeAdapterContractRequiresServiceWorkloadForServiceAdapters' -count=1 failed because service-session adapters could omit service workload kinds
• GREEN: focused runtime adapter contract tests pass

Verification

• GOWORK=off go vet ./...
• GOWORK=off go test ./... -count=1
• git diff --check

Adversarial review

• Kept this declarative: no task, lease, workspace path, mount, network callback, or verifier state enters compute-core
• Added explicit workspace policy for workspace-less adapters such as WASM-style runtimes
• Fixed the service adapter/workload consistency gap before PR