feat(runtime): add deterministic device-aware execution planner

[daniele21]

RA-8A — deterministic execution planner

Introduces the pure policy boundary DeviceCapabilities + ModelProfile + ResourceState + Workload -> BackendExecutionPlan.

Safety and determinism

• versioned policy (policyVersion=1);
• no benchmark-time probing or hidden mutable state;
• profile settings are only preserved or downshifted;
• GPU layers, flash attention and mlock remain disabled unless both the profile requests them and the device explicitly declares support;
• memory/thermal pressure deterministically downshifts approved context tiers, batch sizes and thread counts;
• no speculative decoding, unsupported multimodal path or automatic hardware claim is introduced.

Evidence

Tests cover nominal planning, fail-closed acceleration, elevated/severe pressure downshift and exact deterministic replay for identical inputs.

Boundary

This is the software planning contract. Representative-device calibration remains a DEVICE evidence gate and is not claimed by this PR.

Gate

Keep draft until runtime-core compile/unit/Spotless/Detekt and repository validation are green on exact head/current dev.