v0.2.0 - Dynamic per-team instances

Per-team isolated challenge instances with an in-process scheduler: mark a
container challenge per_team and each team starts its own container (own port,
own unique flag, per-team network) with spawn/expire/extend/quota handled
automatically. Adds per-instance dynamic flags with sharing detection, the
runtime hardening pass (read-only rootfs + tmpfs, per-team networks, egress
control), an admin instances fleet view, and per-team example challenges.

Backwards compatible: a v0.1 all-shared/static event upgrades in place and
behaves identically. Migration 0002 is additive and non-destructive.

All CI green: unit + testcontainers integration (race), dockerint runtime
(incl. cross-bridge network-isolation probe), lint, web, image, compose smoke,
and Playwright e2e (three v0.1 flows unchanged + the per-team instance flow).