feat(lab12): kata vs runc isolation + perf benchmark

[raylduk8]

Goal

Install Kata Containers, compare runc vs kata isolation and performance, and demonstrate the security trade-off with real benchmarks.

Changes

• submissions/lab12.md: full lab submission with isolation comparison, startup, I/O benchmarks, trade-off analysis

Testing

sudo nerdctl run --rm alpine:3.20 uname -a

sudo nerdctl run --rm --runtime=io.containerd.kata.v2 alpine:3.20 uname -a

---

• Task 1 — Kata installed; both runtimes run; kernel diff documented
• Task 2 — Isolation + 5-run startup + I/O benchmark with trade-off analysis
• Bonus — Escape PoC succeeds on runc, fails on Kata (with host-side verification)