Add microsandbox Runtime observation source

[sam2tom]

Goal

Extend the current Runtime observation API and Core Web Dashboard from Docker to the configured single-host microsandbox provider without adding a second public contract or lifecycle authority.

Context

Follow-up to #19 and PR #15. The pinned microsandbox Go SDK v0.7.2 exposes point-in-time metrics through SandboxHandle.Metrics, including cumulative vCPU time, memory usage/limit and uptime. Core must continue to invoke the SDK only through the existing one-shot Linux helper.

Scope

• implement runtimeobs.Source on the microsandbox provider
• add a read-only helper metrics operation with exact allocation and compute-incarnation verification
• normalize vCPU time to cumulative CPU seconds, configured vCPU count to capacity, SDK memory usage/limit, and uptime to compute start time
• map stopped/suspended compute and disabled/unavailable SDK metrics to existing safe observation states
• register the selected single managed provider as the observation source after the current main/provider configuration merge
• update provider-neutral design/deployment documentation and focused tests

Boundaries

• no new Dashboard, public endpoint, migration, history store or lifecycle action
• no token duplication; Dashboard keeps joining canonical Session usage
• no use of instantaneous SDK CPUPercent for the cumulative CPU contract
• disk, network, host RSS and overlay metrics remain future public-contract work
• no provider-native names, IDs, labels, paths or raw SDK errors in public responses
• no sampling of suspended snapshots as zero resource usage

Acceptance

• an owned running current compute returns the same normalized CPU/memory fields as Docker
• restored generations are sampled by the persisted exact compute identity, never by display-name search
• foreign installation/allocation/compute identities fail closed
• stopped, paused, suspended, metrics-disabled and no-current-sample conditions return safe unavailable states
• observation never creates, renews, resumes, pauses, snapshots, stops or removes compute
• pure-Go provider tests, Linux helper tests, API/client/Web regressions and make check pass, subject to documented environment prerequisites