docs(runtime): select disposable VM isolation target

[Pigbibi]

Decision

Treat the current Binance execution host as a normal self-hosted QEMU VPS/VM, not GCE. Select an independent disposable VPS/VM JIT runner as the primary isolation target; keep same-host ephemeral registration as transitional hardening and Cloud Run as a conditional managed alternative.

Evidence recorded

• host profile run 32644765084: QEMU VM, provider still unverified, no secret value read, egress unverified
• accepted parity run 32644960891: GitHub-hosted and current runner both status=ok, dry_run=true, executed=0, suppressed=11
• both targets produced semantic digest c52a7cf15079ef3346b6f45bbd3b48aef59c539e868e7780ea9f535e17fee1ed
• failed setup run 32644766682 is recorded honestly; it stopped before fixture execution and was fixed by merged PR fix(runtime): target temporary shadow environment #162

Scope

Documentation only. Adds the final cost/isolation/egress/secret/rollback/maintenance comparison, migration sequence, and rejected unsafe shortcuts. Creates no GCP, VM, runner, IAM, network, registry, or secret resource and does not change live.

Validation

• git diff --check passed
• references are official GitHub and Google Cloud documentation