Guard autonomous performance execution against cloud spend

[sarthakagrawal927]

Summary

• add immutable local zero-egress performance plans and cost/egress receipts
• enforce remote-network denial for Node/browser work and macOS-sandboxed Go work
• route direct profiles, supervision, campaigns, CLI, and MCP through admission
• document local, public-smoke, and unsupported hosted/load boundaries

Hosted, paid, unknown-cost, load, soak, stress, and production profiling remain blocked. Approval identity is recorded but does not enable hosted execution. No production configuration, credentials, hosted endpoint, paid service, or dependency was changed.

Verification

• pnpm test:runtime-failure-capsule — 150/150
• pnpm lint
• node scripts/check-docs.mjs
• openspec validate --all --strict
• change-size gate — 25/40 files, 1,726/4,000 additions, 1,800/6,000 gross lines
• diff check

Closes #105