runtime: add explicit pressure-policy dry-run API

[daniele21]

Wave 12 / B6d non-destructive pressure integration.

• adds admin-only POST /api/v1/residency/pressure/evaluate
• each explicit call samples the current host resource observer, classifies memory pressure and advances the existing hysteretic pressure evaluator
• returns current pressure state, trigger/clear streaks and deterministic eviction candidates without unloading anything
• preserves resident-default/pin/active protections through the existing residency snapshot and selector
• UNKNOWN resource observations remain fail-conservative and never create an eviction candidate
• response explicitly reports mode=dry_run, action_executed=false, automatic_eviction_enabled=false and no reclamation claim
• exposes only bounded host total/available/thermal resource values; process RSS is not copied into this policy surface
• uses POST rather than GET because evaluating a sample advances hysteresis state
• composes the dry-run route into supported product entrypoints only when admin API is enabled
• adds deterministic tests proving two critical samples can trigger a candidate while every runtime remains resident

This PR is intentionally the furthest pressure policy can go before representative hardware review. It does not add a background sampler and cannot automatically evict a runtime.