feat: Bubblewrap (Linux) ExecutionResourceProvider

[drscrewdriver]

• Add BubblewrapCodeExecutionResource with bundle/manifest/grant validation
• Add BubblewrapExecutionResourceProvider conforming to 4.1.4.2 contract
• provider_id=bubblewrap, supported_kinds=(code_execution,)
• Implements async_probe/async_ensure/async_health_check/async_release
• Linux-only conditional import in init.py
• Supports bind_ro/bind_rw/tmpfs/unshare_all/share_net configuration

[Maplemx]

Maintainer integration draft: #352.

#352 preserves this PR's six commits and authors, merges current dev, and removes arbitrary bind/tmpfs/extra-argv escape hatches. Deterministic and full tests pass, but both GitHub Ubuntu 24.04 and 22.04 hosted runners block unprivileged Bubblewrap under their default security policy.

Per #342's evidence rules, #336 remains open and #352 remains draft until a representative Linux runner can produce real mechanism evidence without weakening AppArmor/userns policy.

[Maplemx]

Maintainer handoff back to contributor

@drscrewdriver, the Bubblewrap direction is being handed back to your original PR #336 because the available maintainer environments cannot produce honest unprivileged mechanism evidence:

• GitHub Ubuntu 24.04 hosted runner: bwrap_user_namespace_blocked
• GitHub Ubuntu 22.04 hosted runner: bwrap_user_namespace_blocked
• repository self-hosted runners: none
• we will not disable AppArmor, change userns sysctls, use sudo bwrap, or use a privileged container as substitute evidence

The maintainer integration draft #352 preserves your six commits and contains reusable corrections:

• 1b3cdea3 — grant-only mounts, controlled child env, real probe/health, truthful capability reporting
• 33d843d6 — consolidated docs and mechanism workflow
• e8c2f978 — Ubuntu 22.04 characterization attempt

Please resume ownership through #336 (or a successor based on current dev) and adapt/reuse those changes as useful. The acceptance gate is a real run on a representative Linux host—your Ubuntu homeserver is suitable if Bubblewrap works there under its normal security policy—showing:

1. granted output write succeeds;
2. ungranted host read/write fails;
3. network namespace is isolated by default;
4. no AppArmor/userns weakening was needed;
5. provider/conformance and cleanup tests pass.

When the branch and evidence are ready, mention #342 and we will review it promptly. #336 remains open as the active contributor-owned PR.

[Maplemx]

@drscrewdriver，补充 #336 的架构验收边界：#354 已修正并合入 dev，具体隔离机制统一视作插件。

更新 #336 或 successor 时请保持：

• Bubblewrap 仅实现/注册 provider_id="bubblewrap"、supported_kinds=("code_execution",)；
• 不向 core sandbox= 添加 bubblewrap、别名、专属 isolation 默认值或配置分支；
• 应用通过 enable_code_runtime(..., providers=["bubblewrap"], isolation=...) 选择它；
• Bubblewrap 专属配置留在候选描述符和 provider 内部；
• 现有真实 Ubuntu host 证据要求不变，环境阻止 unprivileged Bubblewrap 时请原样报告。

已接受的 gVisor、Seatbelt、Landlock 实现与贡献历史没有被改写；本次只是把选择逻辑从 core 收回到通用 provider seam。