feat: V8 process isolation (part 1)

[NathanFlurry]

Summary

Standalone V8 process isolation runtime for secure-exec — full implementation from scaffold to context snapshots.

• Rust V8 runtime (crates/v8-runtime/): IPC message types, length-prefixed framing, V8 platform/isolate lifecycle, UDS listener with socket security, connection auth, session management, V8 context hardening, sync/async bridge calls, CJS/ESM execution, session event loop, streaming event dispatch, timeout enforcement, structured error serialization, FD hygiene
• TypeScript IPC client (packages/secure-exec-v8/): @secure-exec/v8 package with IPC client, process spawning/lifecycle, session abstraction, binary header codec, V8 serialization pipeline
• Runtime integration: NodeExecutionDriver updated to use V8 runtime via v8Runtime option, bridge contract updated to remove ivm.Reference types, isolated-vm dependency removed
• IPC performance: binary header + V8 serialization (replacing MessagePack), code caching, bridge code caching on Rust side, buffer management improvements, poll(2) accept loop, JSON double-serialization removal, per-session buffering, batched module resolution, pre-allocated serialization buffers
• V8 context snapshots: snapshot creation/restore, thread-safe LRU cache, WarmSnapshot IPC message, eager warm-up on module load, snapshot security tests
• Platform packages: prebuilt binary npm packages per platform, Docker build for linux-x64, Rust CI workflow
• Docs & tests: process isolation docs page, security model updates, integration/crash-isolation/IPC-security/snapshot tests, context snapshot benchmarks
• Release: v0.1.1-rc.1 and v0.1.1-rc.2 with ESM/CJS compat fixes

Companion to #15 (ralph/v8-runtime). This PR covers the full US-001 through US-073 implementation scope.

Test plan

• pnpm test passes for @secure-exec/v8 package (IPC binary, round-trip, crash isolation, IPC security, process isolation, snapshot security, context snapshot behavior)
• pnpm test passes for secure-exec package (bridge registry, console formatter, context snapshot behavior, payload limits, bridge hardening)
• Rust crate builds: cd crates/v8-runtime && cargo build
• Platform binary postinstall works on supported targets
• Context snapshot benchmarks show improvement (see results/context_snapshot_comparison.md)

🤖 Generated with Claude Code