feat: add default provider runtime contract

[intel352]

Summary

• adds ProviderRuntimeContractOptions
• adds DefaultProviderRuntimeContract for the executor/security/proof runtime matrix
• keeps default profile construction centralized in compute-core protocol

TDD

• red: TestDefaultProviderRuntimeContractBuildsRuntimeMatrix failed because the shared constructor and options type did not exist
• green: implemented the constructor over DefaultProviderRuntimeProfile

Verification

• GOWORK=off go test ./protocol -run 'TestDefaultProviderRuntimeContractBuildsRuntimeMatrix|TestProviderContractAppliesProviderConformanceEvidence|TestProviderContractAcceptsBatchSandboxedOCI' -count=1
• GOWORK=off go test ./... -race -count=1
• git diff --check