Complete Phase 1 runtime guarded wiring

[chrisgeo]

Summary

• Adds guarded healthcheck CLI emission for runtimes that expose --health-cmd / --health-* flags, while preserving warn-skip behavior on older runtimes.
• Routes programmatic network creation through the runtime abstraction and carries fork-backed network options into RuntimeCreateNetworkSpec.
• Adds guarded blkio_config emission for runtimes exposing the CHAOS-1380 --blkio-* flags.
• Updates runtime protocol docs, feature parity notes, migration guidance, and the restart prompt; records CHAOS-1379 GPU passthrough as a platform-blocked spike.

Validation

• swift test --parallel --filter GpusBlkioTests
• swift test --parallel --filter 'BridgeContainerClientRuntimeTests|LifecycleArgsTests|RuntimeArgvTests|ComposeUpNetworkCreationTests|GpusBlkioTests'
• CLANG_MODULE_CACHE_PATH=/tmp/container-compose-clang-cache SWIFTPM_ENABLE_PLUGINS=0 swift build
• git diff --check

Dependencies

• Healthcheck runtime support is expected from full-chaos/container PR fix: line-buffer streaming relay so multi-line output isn't fragmented (PLAN.md §4) #16.
• Block I/O runtime support depends on feat(api): Add blkio resource flags container#17, which depends on feat: Add LinuxContainer block I/O resources containerization#1.

Notes

AGENTS.md and docs/reviews/refactoring-review.md are unrelated local worktree changes and are intentionally not included.