Add the BYO host provisioning profile section and profile policy

Part of #1814

## Problem

`ProviderRuntime.profile_policy` is a required field, and `ProviderSection` knows only
`remote_libvirt_section` today. A BYO host has no provider section, so #1817's skeleton can only
ship a stub policy. This entry replaces it with the real provisioning contract an agent sees.

The hard part is `boot_method`, which **has no correct existing value**. The current validators
pair `disk-image` exclusively with remote-libvirt, and require `kernel_source_ref` for
`direct-kernel`. An adopted host fits neither: it already runs an OS with its own bootloader, and
the kernel arrives *after* provision, at install time. The validators must be extended rather than
bypassed — a profile that silently skips the pairing rule is how a provider-specific special case
leaks into a shared model.

## Evidence

- `src/kdive/providers/core/runtime.py:137` — `profile_policy` is a required `ProviderRuntime`
field, not an optional capability group.
- `src/kdive/profiles/provisioning.py:283` — `ProviderSection`, currently
`remote_libvirt_section` only.
- `src/kdive/profiles/provisioning.py:394` — `_pair_boot_method_with_provider`: "`disk-image` and
the remote-libvirt section require each other (ADR-0080)".
- `src/kdive/profiles/provisioning.py:454` — `kernel_source_ref` is required for `direct-kernel`.
- The answer to the boot-method question is decided in #1815 (open question 2); this entry
implements it.

## Expected outcome

- `ByoHostProfile` and `ProviderSection.byo_host_section`.
- A `ByoHostProfilePolicy` replacing #1817's stub, wired into the runtime.
- `boot_method` pairing and `kernel_source_ref` rules extended to cover the adopted host per
#1815's decision, with the rejection path tested — a mismatched profile fails at
`systems.create` with a message naming what is wrong, never a silent acceptance.
- Agent-facing text updated in the same change: the MCP wrapper docstring and `Field`
descriptions, not only the inner handler, since FastMCP serializes only the wrapper.

Blocked by #1817

Start with the #1815 boot-method decision and #1817 skeleton, then inspect src/kdive/providers/core/runtime.py:137 and src/kdive/profiles/provisioning.py at the ProviderSection and validator locations named in the issue. Trace how the MCP wrapper docstring and Field descriptions are exposed. Done means the BYO host profile and policy are wired into the runtime, validation rejection is tested through systems.create, and the agent-facing text is updated.

Written by the indexing model from the issue text.