[stack 39/39] Apple Container mount boundary

[sarthakagrawal927]

Summary

• select the signed Apple container CLI as the first macOS external-prerequisite sandbox adapter
• add a pure Rust read-only mount planner with canonical containment and source-identity revalidation
• record warm-start, idle-resource, signing/bundle, TOCTOU, and remaining runner gates without claiming shipped isolation

Measured evidence

• cached no-op: 0.61s
• idle services: 17,568 KiB RSS total and 0.0% CPU across three samples
• retained cache: 1.45 GB; no new image was pulled
• mount-policy fixtures: 5/5 pass

Verification

• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml apple_container::tests --lib
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml capabilities --lib
• cargo clippy --manifest-path apps/desktop/src-tauri/Cargo.toml --lib -- -D warnings
• node scripts/check-docs.mjs
• pre-push Biome and full-history Gitleaks

Boundaries

• no production dependency or bundled runtime
• no UI surface, container launch, image pull, release, or isolation availability claim
• supervised execution, local-image/version preflight, network attestation, cancellation, bounded output, cleanup, and real-workload qualification remain fail-closed

Tracks #197.