Define secure execution environments and workspace leases

## Parent and milestone

- Parent issue: #43
- Milestone: not scheduled; design follows #42 and implementation starts after
#15.

## Problem

Runtime adapters identify an agent but do not define where it executes. Without
a separate environment contract, concurrent or remote agents can share dirty
state, credentials, processes, and host access unintentionally.

## Outcome

Define a versioned `ExecutionEnvironment` and fenced `WorkspaceLease` contract
for isolated repository state, process ownership, permissions, resources,
artifacts, and cleanup.

## Scope

- Define repository source, base revision, worktree/clone identity, branch,
dirty-state policy, mounts, and cleanup.
- Define sandbox profiles for filesystem, network, process, CPU, memory, disk,
time, and platform guarantees.
- Keep environment identity independent of runtime, provider, worker, and node.
- Define local process, container, VM, and future remote environment capability
levels without claiming equivalent isolation.
- Fence mutation, cancellation, artifact export, and destruction by run and
lease epoch.

## Non-goals

- Selecting one container or VM vendor.
- Building a complete cloud development environment.
- Allowing silent fallback to host execution.

## Acceptance criteria

- [ ] Lifecycle, identity, capability, and cleanup contracts are documented.
- [ ] Unsupported isolation requirements reject the task before agent start.
- [ ] Concurrent tasks cannot share mutable workspaces by default.
- [ ] Crash, cancellation, stale lease, and orphan cleanup scenarios are
specified.
- [ ] Conformance fixtures and operator documentation requirements are defined.

## Validation

- Threat-model review and failure matrix across process, container, VM, and
remote-node implementations.

## Dependencies

- #11 ownership and fencing, #14 configuration, #26 runtime contract, and #42
product gate.

Start by reading dependency issues #11, #14, #26, and #42 to understand the ownership, configuration, runtime, and product-gate contracts. Define the versioned ExecutionEnvironment and WorkspaceLease contracts, then document capability rejection, workspace isolation, lifecycle and cleanup scenarios, conformance fixtures, and operator requirements. Validate the result with a threat-model review and failure matrix across process, container, VM, and remote-node implementations.

Written by the indexing model from the issue text.