feat: add dedicated Lambda hosted-app runner

[danny-avila]

Summary

• add a dedicated lambda-microvm-app-host image and feature-gated resident-server control API
• restore a stateful workspace revision, then supervise one immutable app revision on a fixed preview port
• isolate the app with a dedicated cgroup, PID/memory limits, a no-new-privileges UID/GID/capability drop, and fail-closed IPv4/IPv6 outbound rules
• serialize unexpected-exit cgroup cleanup with start/stop so an old sweep cannot kill a replacement revision
• disable ordinary /execute work on app-host images and bind every control operation to the authenticated runtime session
• extend the provenance-checked Lambda artifact builder and runbook for the separate app-host image

Boundary

This is the Lambda resident-server adapter and image/runtime contract. The fleet-level app lease registry and owner-authenticated preview gateway are delivered by stacked PR #58; raw AWS endpoints/tokens are explicitly not exposed by this PR.

Verification

• env -u AWS_CA_BUNDLE bun test in api — 366 pass, 16 skipped, 0 failed
• focused hosted-app supervisor + route tests — 13 pass
• bash -n for both Lambda artifact builder and hosted-app launcher
• exact-head CI — 5/5 green at 7aaab6c

bun test without unsetting the workstation-provided AWS_CA_BUNDLE makes three pre-existing hardened-startup tests intentionally reject that inherited secret-like AWS environment variable; the clean-env run above passes the full suite.