feat: implement RFD 2 self-hosting contract

[darwin67]

Summary

• document the supported OCI runtime contract for local and S3-compatible deployments, including migrations, bootstrap, TLS, upgrades, backup, restore, and integrity drills
• add liveness/readiness probes and runtime Postmark sender configuration for production onboarding
• harden read-only container examples with ephemeral release configuration storage
• fix the platform-admin release wrapper to transport arguments safely across RPC and return failures correctly
• extend unit and container regression coverage for the documented operational commands

Verification

• mix precommit — 521 tests passed
• packaged production release built successfully
• packaged admin wrapper grant, audit event, and failure status verified against PostgreSQL
• shellcheck rel/overlays/bin/grant-platform-admin
• all 11 documented shell examples pass bash -n
• make check-rfds

Created by Darwin Wu (darwin67).