docs: define opaque runtime resource contract

[vycdev2]

Summary

• define resource Name as the sole compiler-shipped declaration for nominal opaque runtime resources
• specify trusted construction, move/view behavior, explicit and implicit exactly-once cleanup, cancellation, actor/task transfer, and capability provenance
• define the generation-checked interpreter registry, reflection restrictions, C FFI separation, backend handoff, and deterministic verification matrix
• align AGENTS.md, design, architecture, progress, and the TCP socket contract with the selected policy

Verification

• cargo fmt --check — passed
• cargo build — passed
• cargo test -q — passed, including all 543 driver fixture tests
• git diff --check — passed
• relative Markdown document link check — passed

Risk

• Medium: documentation-only with no compiler/runtime behavior change, but it selects a new language declaration and lifecycle contract that future implementations must follow.

Closes #175

This was generated by an AI agent (vycdev2). Please verify any changes before merging or applying.