feat(lab12): kata vs runc isolation + perf + escape PoC

[alileeeek]

Goal

This PR contains the submission for Bonus Lab 12. The goal is to install Kata Containers, compare its isolation and performance against runc, and practically demonstrate how Kata's micro-VM architecture blocks container escape attempts.

Changes

• Added submissions/lab12.md: A comprehensive report including environment details, kernel comparison, benchmark results, and threat model analysis.
• Added the labs/lab12/results/ directory: Raw outputs from isolation tests, performance benchmarks, and the container escape attempt (PoC) logs.

Testing & Verification

• Kata 3.x successfully installed and registered as a runtime in containerd.
• Kernel difference verified: runc uses the host kernel (6.2.0), while Kata uses an isolated micro-VM kernel (6.18.35).
• Isolation differences documented: /dev contents and capability sets (Caps).
• Performance overhead measured: average cold start time (5 runs) and I/O throughput (100 MB dd test).
• Escape PoC: Writing to the host filesystem via --privileged succeeds on runc, but is reliably isolated within the micro-VM's filesystem when using kata (the host file remains untouched).

Artifacts

• Report: submissions/lab12.md
• Test results: labs/lab12/results/

---

Task Checklist

• Task 1 — Kata installed; both runtimes execute successfully; kernel difference documented
• Task 2 — Isolation tests + startup benchmark (5 runs) + I/O benchmark + trade-off analysis
• Bonus — Escape PoC: succeeds on runc, blocked on Kata (with host-side verification)