lab12: add kata evidence runner and preflight submission

[Walkerino]

What changed

• Added submissions/lab12.md with real host preflight output.
• Added labs/lab12/scripts/run-lab12-evidence.sh, a reproducible evidence runner for a Linux/KVM host.
• The runner collects:
  • Kata installation evidence
  • runc vs Kata kernel comparison
  • /dev and capability isolation diffs
  • startup and I/O benchmarks
  • privileged-container escape PoC evidence

Environment note

The current workspace is macOS arm64 / Docker Desktop. Kata Containers require Linux with readable /dev/kvm, plus containerd and nerdctl.

On this host:

• /dev/kvm is not available
• containerd is not installed
• nerdctl is not installed
• Docker Desktop LinuxKit also does not expose /dev/kvm

Because of that, Kata runtime evidence was not fabricated. The included runner is ready to execute on a proper Linux/KVM machine.

Validation

• bash -n labs/lab12/scripts/run-lab12-evidence.sh passed.
• Runner guard was tested and correctly exits on macOS with:
  Lab 12 requires Linux with KVM; current OS is Darwin.

Checklist

• Task 1 - blocked locally by missing Linux/KVM host
• Task 2 - runner added, requires Linux/KVM execution
• Bonus - runner added, requires Linux/KVM execution