Add shared runtime tenant policy

[NavinAgrawal]

Summary

• add the Phase 3 shared-runtime policy module for tenant context, isolation domains, and upstream placement decisions
• document the threat model and tenant model while keeping hosted execution unsupported
• extend journey docs coverage plus unit contracts for fail-closed defaults

Verification

• private make precommit PYTEST_WORKERS=0: 1371 unit passed, 151 journey passed, 0 failed, 0 skipped
• private make maintainer-violations PYTEST_WORKERS=0: 0 violations, 12 test-file-size advisories
• private make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0
• public make precommit PYTEST_WORKERS=0: 1371 unit passed, 117 journey passed, 0 failed, 0 skipped
• public make maintainer-violations PYTEST_WORKERS=0: 0 violations, 12 test-file-size advisories
• public make maintainer-grade-quality PYTEST_WORKERS=0: A+ 100.0

Mutation was not run locally to avoid saturating the Mac.