docs(runtime): specialize isolation plan for OCI

[Pigbibi]

Updated fact

The current Binance self-hosted runner is a user-owned Oracle Cloud Compute VPS/VM. Record that as an operator-attested fact while keeping the exact instance OCID and egress fingerprint out of public artifacts.

Recommendation

Prefer a separate, on-demand OCI Compute JIT runner launched from a pinned custom image, placed in a private subnet, routed through an OCI NAT gateway with a reserved public IP, authorized through a narrowly tagged instance-principal dynamic group, and terminated with boot-volume deletion after one job.

• same-OCI-host ephemeral registration remains transitional only because the host persists
• Cloud Run remains a cross-cloud fallback after container and fixed-egress validation
• OCI preemptible capacity is prohibited for live order/reconciliation work

Added coverage

• OCI-specific cost, isolation, egress, Vault/instance-principal, maintenance, and rollback comparison
• launcher/runtime IAM separation
• reserved NAT address and Binance allowlist boundary
• custom-image and JIT bootstrap requirements
• instance/boot-volume/orphan cleanup
• OCI-specific migration and failure rehearsal sequence

Scope

Documentation only. Creates no OCI/GCP resource, IAM policy, runner, network, Vault secret, allowlist entry, or live change.

Validation

• git diff --check passed
• design references official GitHub, OCI, and Google Cloud documentation