I10: backend override (downgrade / select-available only)

[hartsock]

Part of #139. Depends on I1. (ADR — amends 0006/0009.)

Allow a backend override that is downgrade / select-among-available only: applied = min_capability(requested, best_available_sandbox()); enforcement_report/sandbox_kind derive from applied; fail closed if a restricted grant then can't be met. Forbidden: force-asserting an unavailable/uncompiled backend (that would let the envelope claim kernel with no kernel rule — a lie).

Rationale: operators may force None (honest downgrade) or pick among probed backends, never overclaim.