refactor(vm): split runtime state and add scoped lifecycle

[fffonion]

Summary

• split runtime-owned state from the Vm facade while preserving public behavior
• add scoped resource and operation lifecycle with typed IDs, cancellation, deadlines, quiescence, and reason-aware cleanup
• establish the common lifecycle substrate used by later host adapters

Stack

• Base: master
• Next: refactor(host): migrate IO and SQLite onto scoped lifecycle #18
• Commits: 6f6c82e, f6f0040

Validation

• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• no-default/runtime/no-std checks
• architecture boundary tests