feat: implement robust namespace lifecycle and resilience suite

- Replace marker-file pinning with kernel bind-mount anchors for reliable namespace persistence.
- Implement atomic "last-man-out" cleanup sequence using ProfileLock, preventing namespace leaks and race conditions.
- Add comprehensive resilience test suite covering:
    - Crash recovery from stale runtime state.
    - Host network change stability.
    - Configuration hot-swap session persistence.
    - Resource exhaustion and high-churn lifecycle stress.
- Align documentation and test expectations with rootless session-based persistence.
- Fix argument integrity and isolation leaks.
- Ensure 100% pass rate for all E2E and integration tests.

0 files changed, 0 insertions, 0 deletions