feat: promote Capsule to central resource-ownership domain object

[j143]

Summary

Promotes Capsule from a legacy name/version/path record into the central ownership and lifecycle object for networks and attached containers.

Why

The existing ResourceCapsule stores only a name, version, and path. It does not own resources, track members, survive state transitions, or prevent unsafe deletion. Meanwhile, CreateNetwork registers a Capsule, but DeleteNetwork does not remove or reconcile it.

Changes

• Add a persistent, mutex-protected CapsuleStore.
• Add Capsule membership and resource ownership.
• Make networks owned by Capsules.
• Make container network attachment a Capsule membership operation.
• Block Capsule/network deletion while containers remain attached.
• Add tests for lifecycle, membership, persistence, and deletion protection.
• Add ADR-004 documenting the Capsule ownership invariant.

Non-goals

• No change to cgroup enforcement.
• No change to namespace isolation.
• No implementation of real container networking or ICMP-based Ping.
• No removal of the legacy Kubernetes Capsule commands.

Follow-ups

• Move container creation under a Capsule.
• Add CPU, memory, PID, and storage limits to Capsule.
• Replace the simulated Ping with real network validation or remove it.