feat: share resource constrained executor check

[intel352]

Summary

• Add core executor capability DTOs for resource-limit placement checks.
• Add shared helpers for CPU/memory limits requiring a resource-constrained executor and for matching worker executor capabilities to placement requirements.

Verification

• RED: GOWORK=off go test ./protocol -run TestExecutorCapabilitiesHaveResourceConstrainedMatch -count=1 failed before implementation with missing API symbols.
• GOWORK=off go test ./protocol -run TestExecutorCapabilitiesHaveResourceConstrainedMatch -count=1
• git diff --check
• GOWORK=off go test ./... -count=1

Adversarial Review

• Kept provider capability reports out of this helper because support/degraded validation is a separate workflow-compute policy path.
• Preserved existing semantics: CPU or memory limits require constrained execution; workspace-only limits do not.
• Legacy tier-only workers are still handled when explicit executor refs are absent.