Prove runtime contract conformance

[kiroro123]

Summary

• Add core/runtime_protocol.py with the SessionRuntime protocol used by SessionRunner.
• Add a non-ignored Mypy contract module proving concrete NetShaper conforms to SessionRuntime.
• Match the protocol's add_target(...) signature to the real NetShaper.add_target(...) API instead of accepting arbitrary kwargs.
• Validate SessionPlan.authorized_cidrs against the runtime authorization policy before any host mutation.
• Add regression coverage for scope mismatch failing before state save, global rules, or target setup.

Validation

• .venv/bin/python -m coverage run -m pytest -q -> 364 passed, 5 skipped
• .venv/bin/python -m mypy -> clean across 49 source files
• .venv/bin/python -m ruff check .
• .venv/bin/python -m bandit -c pyproject.toml -r src/netshaper
• Coverage gates: session_plan 98.63%, session_runner 97.37%, portal_manager 99.13%, elevated combined gate 82.60%

Context

PR #25 was already merged with commit 1608708; this PR carries the follow-up commit 61e1921.