MicroVM: guest root (passwordless sudo) can read

Task 7435 fenced the guest's `runtime.*` verbs to the ACP host with a once-per-launch capability (`runtime.host_claim`). The host keeps it in memory and makes itself non-dumpable. But the guest user has `sudo: ALL=(ALL) NOPASSWD:ALL` (`apps/jaahd/microvm_seed.py`), so an agent that escalates to root can still read the host's memory and forge its events. `apps/jaahd/README.md` §"The ACP host runtime" records this as the remaining limit. Ask: close it. Either run the engine as a guest uid distinct from the host's without sudo, or drop NOPASSWD sudo for the session user and keep root-only setup in cloud-init/bootcmd. Then delete the remaining-limit sentence from the README. Out of scope: MicroVM egress, VM lifecycle, the static-node pid fence. Done means: - A guest test shows the agent's process tree cannot become root or ptrace/read the host process, and runtime.* calls from it are refused. - The README limit sentence is gone. Required checks: ./dc check full

Guest user has no sudo and no groups; Docker is now a rootless engine (ADR-0119 shape); base marker proves no root. Guest test and README updated. Quick gate and review lanes green; PR #6040 merged. Live guest boot unverified, follow-up draft #7498.