v0.4: prove containerd CNI identity and deny-before-start handoff

Parent epic: #6
Depends on the contract issue and research #65.

Build a disposable chained-CNI probe for the exact k3s/containerd target. Prove that one invocation receives matching `K8S_POD_UID`, sandbox container ID, `CNI_NETNS`, `prevResult`, and `runtimeConfig.cgroupPath`; installs Pod-parent deny before returning; and returns an error without opening traffic when intent or capability is missing.

Cover amd64 and arm64, duplicate ADD, CHECK, DEL with missing netns, GC, rapid Pod replacement, user init/native-sidecar/app first-packet capture, and composition after Flannel/portmap/bandwidth. Do not modify production workloads. Restore the exact prior conflist and remove every probe resource.