Align Linux runtime realization with agentplane and sourceos-spec boundaries

[mdheller]

Recent design work around container managers, orchestration phases, and governed execution needs a Linux realization lane that stays inside this repo's declared boundary.

This repo should own:

• host roles, profiles, images, and builders
• Linux-facing runtime/container manager integration
• installer/bootstrap/image realization
• machine-level realization of the agentplane contract

This repo should not redefine:

• shared schema canon from SourceOS-Linux/sourceos-spec
• execution lifecycle semantics from SocioProphet/agentplane

Follow-up requested:

• add or update a short note under docs/ clarifying where CRI-O/containerd, Podman/toolbox, VM/container isolation, and related Linux runtime decisions belong
• map these Linux realization concerns back to agentplane and sourceos-spec
• keep vendor-specific environment references as realization details, not canonical contract identity

Acceptance criteria:

• Linux realization placement note added or updated
• explicit boundary to agentplane and sourceos-spec recorded
• backlog created for concrete host/image/runtime implementation follow-ups