fix(runtime): calibrate development warning admission

[roodboi]

macOS warning pressure (level 2) currently refuses Development startup even when sampled headroom, swapouts and thermal state pass. Admit an explicitly observed warning under the existing 10 GiB startup budget, while critical or unknown pressure still refuses. Research remains normal-only with its existing memory, disk, load and sampling envelope.

Development now samples a fresh three-observation window after acquiring the startup lease, before creating ownership, aliases, disks or provider capacity. Swapouts must match the pre-lease baseline. Live warning checks require 4 GiB of estimated host headroom plus measured provider footprint above the provisional 6 GiB guest + 2 GiB overhead estimate; normal checks retain 2 GiB plus that excess. This is not a provider-footprint cap. Failed pressure, swapout or thermal checks refuse effects without refreshing the live guard. Cleanup keeps its existing ownership boundary.

Admission JSON adds the numeric pressure level and typed normal/warning/critical/unknown state. The compatibility memory_pressure_normal boolean remains literal normal-only and is false for an admitted warning. Saved reports do not grant resource authority. No bypass flag, VM resize or lower memory/disk floor is added.

Validation:

• Full default Rust gates: 1,113 passed, 63 existing native/manual tests ignored; formatting and all-target Clippy with warnings denied passed.
• Full all-feature Rust gates: 1,240 passed, 95 existing native/manual tests ignored; all-feature/all-target Clippy with warnings denied passed.
• Independent read-only source review found no concrete blocker.
• After rebasing onto next at b5b3151e, the complete eight-file patch is byte-identical to reviewed commit a60aef60 (SHA-256 ce5ffb17090f9d5b1737ffa0e956d18e8538c903722a88d6ca157b53d0f4f428). The 20 affected admission/live-guard/real private lease controls pass again; Rust formatting, library Clippy, privacy and diff checks pass. Unchanged full suites were not repeated.

This is the NC05 admission blocker follow-up. Actual warning-state host startup and operating qualification remain unrun. No VM, Docker, fleet or app activation was performed, and no performance improvement is claimed. Fresh CI and source review on the final PR head remain required before integration.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}