Enforce per-container PID limits

[sturdy4days]

Closes#853

Summary

• Expose optional per-container PID limits through LinuxContainer.Configuration while preserving omission and OCI 0/-1 semantics.
• Apply resources before workload execution and admit processes atomically with clone3 into the target cgroup.
• Keep finite-limit cgroup views read-only inside workloads and cover container, pod, and exec behavior.

Security rationale

PID limits must fail closed before workload code can run. Atomic cgroup admission prevents a process from briefly running outside its PID controller, and read-only finite-limit cgroup views prevent workloads from raising their own ceiling.

Testing

• Focused PID unit coverage: 8/8 passed.
• Runtime integration scenarios: 6/6 passed.
• Alias coverage: 1/1 passed.
• Linux suite: 600 tests across 79 suites passed.

The runtime coverage is arm64/vmexec scoped. This PR does not claim a release, NanoClaw integration, activation, or live deployment.