Add Apple Container samples and qualification

[Richie Gomez (richiemsft)]

📖 Description

Adds the samples and local qualification layer for the experimental Apple
Container one-shot backend introduced by #972.

• adds raw allow-network and default-block 0.8.0-alpha configurations;
• updates the Node SDK example and runtime guidance;
• expands real-runtime coverage for streams, mounts, timeout cleanup,
  concurrency, network isolation, firewall tamper resistance, and hard-exit
  recovery;
• adds a local network-boundary harness that reproducibly builds and verifies
  the pinned MXC init image before qualification;
• hardens mount overlap validation, recovery record creation, and bounded
  cleanup uncovered by the qualification suite.

The Apple Container qualification remains local-only and does not add a CI
workflow.

🔗 References

• Implement Apple Container CLI runtime #972

🔍 Validation

• Validated 234 example/config files against the dev schema.
• Built the Node SDK and passed the three targeted Apple Container unit tests.
• Passed all 25 apple_container_common unit tests.
• Passed all eight ignored real-runtime Apple Container qualification tests.
• Passed the local Apple Container network-boundary qualification.
• Ran both raw sample configurations through mxc-exec-mac.
• Passed the exact macOS release build/test package matrix and Clippy with
  warnings denied.
• Passed Rust formatting and diff whitespace checks.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)
• If this PR changes Cargo.lock, the dependency-feed-check check passes (see docs/pull-requests.md)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with
the GitHub Actions build; it runs on merge to main, and Microsoft reviewers
with write access can trigger it on a PR with /azp run.

Microsoft Reviewers: Open in CodeFlow

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Branden Bonaby (bbonaby)]

issue (non-blocking): This finally handles ordinary failures, but Node exits immediately on the default SIGINT/SIGTERM behavior, so Ctrl-C during any awaited container/network operation skips this cleanup and leaves the labeled resources behind. Since this is an interactive, long-running qualification command, could we install signal handlers that run the same cleanup path before exiting (and ideally reconcile resources carrying OWNERSHIP_LABEL on the next run)?

[Branden Bonaby (bbonaby)]

issue (non-blocking): This now documents Apple Container as executable, but docs/schema.md still says the backend is config-only and runtime execution fails closed with unsupported_containment (the apple_container row around line 278). Could we update that canonical schema reference in this PR as well? The two docs currently give contradictory guidance about whether this example can run.

[Branden Bonaby (bbonaby)]

issue (non-blocking): This adds a third independent copy of the trusted init-image tag, alongside src/backends/apple_container/init/build.sh and NETWORK_BLOCK_INIT_IMAGE in cli.rs. The wrapper runs build.sh but ignores the verified image it reports, then exports this separate literal; after a version bump, a missed update here could either fail qualification or silently exercise an older locally-cached image while production trusts the new tag/digest. Could build.sh expose the canonical tag in a sourceable form (or print it for this wrapper to capture) so the qualification and production invariants cannot drift?