Post-v0.7.19 fixes for containerd localhost networking and investor-bench reliability.

Highlights:

• containerd netns loopback — Host.Realize brings lo up before CNI ADD. Fresh namespaces left loopback DOWN (bridge-only CNI), so 127.0.0.1 / localhost TCP timed out in every containerd sandbox even when a service bound 0.0.0.0. Cold create + warm-pool refill both go through this path.
• SVC-01 postgres sim — TLS expose probes use PublicURL when HostPort is 0 (no more dial tcp :0); init readiness polls SELECT 1 until first-boot initdb finishes.
• UC-94 bench — destroy each runtime's sandboxes before the next so a 6×10 sweep doesn't pin ~60 sandboxes and starve tail runtimes (no worker placement target).

Fragile area: TAP/netns allocator — regression coverage for the lo up call and failure cleanup.

What's Changed

• fix(netns): bring loopback up in containerd sandbox netns
• fix(sims): postgres-supabase TLS expose probe + init readiness (SVC-01)
• fix(bench): tear down each runtime's sandboxes before the next (UC-94)

Full Changelog: v0.7.19...v0.7.20

Full Changelog: v0.7.19...v0.7.20