Implement ext.bwrap: local bubblewrap namespace extension (SAND-WP-0013)

Adds the first local, same-host, kernel-namespace-only sandbox
extension: no SSH hop, no container runtime. Extends IsolationSpec.level
with "process", implements BwrapExtension (provision/wait_ready/
teardown) spawning bwrap with unshared user/mount/pid/ipc/uts/net
namespaces, registers ext.bwrap + profile.bwrap-local, and extends
manager._handle_from_status to carry pid/workspace_dir. Verified with a
live bwrap smoke run in addition to the mocked test suite.

T04 (reachability vs. the SSH-based glas-harness consumer contract)
deliberately left open pending glas-harness's harness contract.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

profiles/profile.bwrap-local.yaml

@@ -0,0 +1,31 @@
+id: profile.bwrap-local
+version: "1.0.0"
+extension: ext.bwrap
+isolation:
+  level: process
+network:
+  default: deny
+  egress: []
+workspace:
+  mode: mirror
+  access: rw
+scope_default: session
+ttl:
+  default: 4h
+  max: 24h
+  idle_reap: null
+resources:
+  cpu: null
+  memory_mb: null
+setup:
+  instructions: ""
+  secret_refs: []
+placement:
+  prefer: [localhost]
+  fallback: []
+reachability:
+  tunnel: ops-bridge
+  identity: ops-warden
+metadata:
+  cost_class: self-hosted
+  latency_class: standard