[Task]: Run the acceptance suite in CI (non-blocking)

[michael-duren]

What needs to be done

Run the acceptance suite in CI so end-to-end regressions are caught, as a
non-blocking job initially (the runtime is still under active development and
the suite is expected to be partially red).

The job should:

• Run on a Linux runner with the privileges the suite needs (per
  [Task]: Research & design the acceptance test harness #18 — unprivileged user namespaces on
  ubuntu-latest, a privileged container, or a self-hosted runner).
• Build box and invoke make acceptance ([Task]: Add a 'make acceptance' target #21).
• Be marked non-blocking (continue-on-error or not a required check) so it
  doesn't red-gate development while the runtime matures.
• Surface results as readable output and upload any logs/artifacts useful for
  debugging failures.

Wire it as a separate job/workflow from the existing ci.yaml Go job so unit
tests stay fast and required while acceptance runs alongside.

Acceptance criteria

• A CI job builds box and runs the acceptance suite on a Linux runner
• The job has the privileges needed for namespace operations (documented)
• The job is non-blocking and does not fail the required CI checks
• Results/logs are visible for debugging
• How to reproduce the CI run locally is documented

Parent / tracking issue

Part of #17.

Blocked by

• [Task]: Add a 'make acceptance' target #21

Rough size

S — a few hours