WASM resident-host: per-instance egress isolation + migrate-on-expose + idle-TTL reaper (PR #339).

Makes the shared resident compile-once/instantiate-many host safe for multi-tenant networking, expose_port, and RAM lifecycle — the work gated before SB_WASM_RESIDENT_HOST_ENABLED can flip on.

Still DEFAULT-OFF (SB_WASM_RESIDENT_HOST_ENABLED unchanged). Flag-off is a byte-for-byte no-op on the existing per-sandbox path. Flip follows the live CPython egress bench.

• Per-tenant egress isolation (structural conn ownership keyed by sandbox; owner-scoped buckets so distinct tenants never co-locate; fail-closed egress)
• migrate-on-expose (cold-up-then-stop; no zero-instance window)
• idle-TTL reaper + conservative capacity + aerolvm_wasm_resident_hosts metric
• SB_WASM_RESIDENT_HOST_MAX_INSTANCES cap + spill

What's Changed

• docs: position AerolVM as self-hosted or managed multi-tenant SaaS by @sumansaurabh in #338
• feat(wasm): resident-host egress isolation + migrate-on-expose + idle-TTL reaper (default-off) by @sumansaurabh in #339

Full Changelog: v0.7.11...v0.7.12