Expose operator-approved microVM profiles to sessions and mecatui

Parent: #526

Outcome

Operators can enable approved microVM environment profiles and local clients can select one without exposing images, mounts, endpoints, resource controls, or security policy to the model/project configuration.

Scope

• Add strict operator-global execution-environments settings containing driver endpoints and public profile aliases.
• Keep privileged image, resource, networking, seccomp, lifecycle, and quota policy enforced by microvmd.
• Add environment_profile to session creation independently from the existing profile tool-surface field.
• Reject project-tier attempts to define or weaken environment drivers/profiles.
• Wire provisioning before durable session creation and per-session engine construction.
• Persist the prepared host worktree as session Workspace while the live Environment Workspace exposes guest /workspace.
• Add safe profile inventory and resolved-environment status to clients without exposing control endpoints or credentials.
• Update mecatui local mode to pass the source path, display source/worktree/guest roles, and support multiple concurrent sessions from one repository.
• Explicitly reject microVM-backed schedules in the first release.

Acceptance

• Empty selection uses the operator default; unknown, disabled, unavailable, or unauthorized profiles fail loudly without local fallback.
• Project settings cannot change the environment selection policy.
• The model can neither select arbitrary images nor alter mounts, egress, resources, seccomp, lifecycle, driver endpoint, or trust roots.
• Existing default/no-fs sessions are byte-compatible when microVM support is disabled.
• Multiple mecatui processes can create independent sessions/worktrees/VMs for one repository and receive accurate resolved paths/status.
• User-facing docs distinguish source checkout, host session worktree, guest /workspace, guest egress, and host service egress.