feat: preserve native workload process policy

[roodboi]

Native workload configuration could not describe image entrypoint overrides, init, shutdown or restart policy. This adds typed, optional process intent to the pure compiler and preserves it through CLI validation and metadata planning. Omitted fields keep their existing plans and hashes; entrypoint.exec: [] explicitly clears an inherited entrypoint. Jobs refuse perpetual restart, including inactive jobs.

The CLI requires process_plan_version: 1 before sending process-bearing input, then checks replies against the authored project, workload namespace, selected profiles and normalized requirements. Missing, altered or invented policies refuse with redacted errors. Generated JSON Schema and TypeScript projections remain Rust-owned.

Validation on a799593:

• Pinned Rust formatting, Clippy with warnings denied, 93 tests, and compiler generation/build.
• Independent JSON Schema/Rust corpus: 280 project + 60 local cases.
• 393 focused process and adjacent boundary tests, including real linked-worktree and metadata-only coverage; typecheck, lint and privacy gates.
• Relocated compiled CLI on macOS and Hack-managed Linux: 145 checks each, with no hooks or runtime state created.
• Independent review; corrected project-identity and sibling profile-selection findings with regressions.
• Final full CLI suite: 2,701 pass, 68 existing gated skips, zero failures; DB task reused valid cache.
• Signed private macOS bundle: checksum/signature verification and 43 installed checks without host Bun/Rust, including actual linked-worktree planning, idempotent installation and deselect/refuse/reselect rollback. Hack-managed Linux also passed all 63 new process tests.

All ten hosted CI jobs and Graphite passed on exact head a799593 (CI run). This PR is a bounded NC02 planning capability; native process delivery and admission are NC03. It does not enable native-authored execution, migrate applications, publish a prerelease or establish performance gains.

Release intent: optional experimental capability (feat), with no stable-line migration or new defaults. HACK-1220 remains open for the rest of NC02.