Tenant isolation: no old-org residue after a transfer

Goal: a tenant cannot reach or affect what another tenant left behind on a shared node, and a guest's tools cannot impersonate the ACP host inside a MicroVM. Each remaining limit is a recorded, deliberate guarantee. Consolidates drafts 7324 and 7317; their findings are in the attached sources-git-and-isolation.md. 1. Org transfer purge: decide and record the guarantee ("named caches" or "nothing readable"; the latter needs a reimage when the session uid was in the docker group). Then remove, or record as an accepted limit, each item: containers, volumes and networks outside compose that no new-org stack holds; /tmp/claude-<uid> scratch; credential- or persistence-bearing dotfiles (~/.npmrc, ~/.docker/config.json, git hooksPath, shell rc, ~/.config/systemd/user, crontab); pip, uv, cargo and Go caches; non-default buildx caches. 2. VM `runtime.*` fence: the guest's ACP host holds a per-launch capability its children cannot read (e.g. a nonce on a 0600 fd, never in env or argv), and `_host_fence` requires it for VM callers. The accepted-limit sentence is then deleted from `apps/jaahd/README.md`. Out of scope: the ordinary erase and sweep path, disk caps, the static-node fence, MicroVM egress and lifecycle. Done means: - A transfer test shows each listed item gone or recorded as an accepted limit. - A test proves a VM caller without the capability is refused `forbidden_arg` on every `runtime.*` verb, and the host holding it is served. Required checks: ./dc check full

Transfer purge now removes the named old-org residue (guarantee: NAMED RESIDUE, limits recorded). Guest runtime.* verbs are fenced to the ACP host's per-launch capability. Quick gate and review lanes green; PR #6011 queued to the merge lane. Guest sudo limit recorded; follow-up draft #7438.