feat(runtime-v2): Wave 3 — workspace manager, checkpoint gating, exec control, gRPC protos

Workspace manager abstraction:
- WorkspaceRuntimeManager gains sandbox-scoped methods (create/terminate/has_sandbox,
  create_container_in_sandbox, setup/teardown_sandbox_network)
- Conformance matrix updated for sandbox operations
- StackExecutor doc comments updated for transitional path

Checkpoint API primitives:
- Capability gating: vm_full/fs_quick class validation against backend capabilities
- Enhanced restore response with compatibility fingerprint metadata
- Fork emits CheckpointForked event + receipt
- New /v1/checkpoints/{id}/children lineage query endpoint

Exec resize/cancel:
- POST /v1/executions/{id}/resize with live_resize capability gating
- POST /v1/executions/{id}/signal for in-band signaling
- ExecutionResized and ExecutionSignaled event variants
- Enhanced cancel with event emission

gRPC transport alignment:
- runtime_v2.proto with 8 service groups (Sandbox, Lease, Container,
  Execution, Checkpoint, Build, Event, Capability)
- Shared RequestMetadata and ErrorDetail DTOs
- Streaming RPCs for exec output and build events

Beads closed: vz-kn4, vz-8ud, vz-pqs, vz-4s7

742 tests passing (480 vz-stack + 25 vz-api + 50 vz-runtime-contract +
21 vz-agent-proto + 166 vz-cli)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: lightsofapollo

crates/vz-agent-proto/build.rs

@@ -1,9 +1,11 @@
 fn main() -> Result<(), Box<dyn std::error::Error>> {
-    let proto_path = "proto/agent.proto";
+    let proto_paths = &["proto/agent.proto", "proto/runtime_v2.proto"];
     let out_dir = "src/generated";
 
-    // Re-run generation if the proto changes.
-    println!("cargo:rerun-if-changed={proto_path}");
+    // Re-run generation if any proto changes.
+    for path in proto_paths {
+        println!("cargo:rerun-if-changed={path}");
+    }
 
     // Only regenerate when explicitly requested; default builds use
     // checked-in output.
@@ -24,7 +26,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
         .build_server(true)
         .build_client(true)
         .out_dir(out_dir)
-        .compile_protos(&[proto_path], &["proto"])?;
+        .compile_protos(proto_paths, &["proto"])?;
 
     Ok(())
 }