feat(isaac): add backend and native ROS 2 Bridge skeleton

[Staaaaaaaaar]

Motivation

Implement roadmap PR 13 to expose the highest-risk Isaac Sim, GPU container,
native ROS 2 Bridge, and cross-container DDS integration points before the
ANYmal C runtime is added.

Scope

• pin the Isaac Sim 4.5.0 x86_64 image by manifest digest;
• add the RoboHarness Kit app and rh.isaac lifecycle extension;
• build a native OmniGraph simulation-clock publisher with
  isaacsim.ros2.bridge;
• publish bounded Env STARTING/ERROR status without claiming READY;
• add the Isaac env image, Compose GPU profile, persistent caches, and external
  ROS 2 Humble validation observer;
• add headless Bridge smoke and local X11 GUI launch workflows;
• document NVIDIA driver, Container Toolkit/CDI, EULA, host variants, evidence,
  and failure routing.

Out of scope

• ANYmal C asset, spawn, articulation, sensors, locomotion, and command path;
• Isaac Lab runtime, policy training, or policy export;
• odometry, TF, sensor, and cmd_vel Bridge graphs;
• complete Env reset/safety contract and READY state;
• full MVP or Episode end-to-end execution;
• remote GUI/WebRTC streaming.

Architecture changes

The architecture baseline now places the complete Isaac Sim x ANYmal C binding
under simulators/isaac/robots/anymal_c and uses the locomotion policy bundled
with Isaac Sim. Isaac Lab is not installed in the MVP runtime. Standard ROS 2
transport remains owned by Isaac Sim's native Bridge nodes; RoboHarness owns
only Kit lifecycle glue, graph configuration, and platform status semantics.

Implementation

• launch /isaac-sim/apps/isaacsim.exp.base.kit and merge the project
  rh.kit, registering both NVIDIA and project extension directories;
• wait for Kit app readiness, initialize SimulationContext asynchronously,
  create the clock graph, and start the timeline;
• construct /RoboHarness/ROS2Clock from OnPlaybackTick, ROS2Context,
  IsaacReadSimulationTime, and ROS2PublishClock;
• build only rh_interfaces in a ROS builder stage and copy the merged install
  into the digest-pinned Isaac image;
• use host networking and host IPC for the bounded Fast DDS validation stack;
• provide make isaac-smoke with retained evidence and guaranteed Compose
  cleanup;
• provide make isaac-gui with scoped X11 authorization, foreground lifecycle,
  and cleanup without rewriting the developer's default headless .env.

Testing

• make dev-check: PASS, 16 packages, 207 tests, 0 errors, 0 failures;
• repository structure, Markdown links, YAML, Bash syntax, Ruff, and Isaac
  skeleton validation: PASS;
• git diff --check origin/main..HEAD: PASS;
• make isaac-smoke: PASS;
  • evidence: .build/isaac-smoke/20260824T083123Z-112676;
  • external ROS 2 Humble observer received /clock as
    rosgraph_msgs/msg/Clock;
  • /roboharness/env/status was discoverable;
  • validation containers remained stable without restart;
• make isaac-gui: GUI window opened and Kit reported app ready; the
  rh.isaac clock graph became active. The first run performed the expected
  RTX RtPso shader warm-up and populated the persistent cache.

Validated host snapshot:

Ubuntu 22.04.5 LTS x86_64
kernel 6.8.0-138-generic
NVIDIA driver 580.173.02
NVIDIA Container Toolkit 1.20.0
Docker Engine 29.7.2
Docker Compose 5.5.0
Isaac Sim 4.5.0
ROS_DOMAIN_ID 42

Generated .build/isaac-smoke/ evidence is intentionally ignored by Git; the
result and environment are recorded here while large logs/image metadata remain
local.

Acceptance criteria

• Scope and out-of-scope match the implementation.
• Build, lint, and relevant tests pass.
• Documentation is updated.
• Acceptance evidence is included.

Known limitations

• Env intentionally remains STARTING; READY requires the robot, sensors,
  reset behavior, and command safety gate from later PRs.
• The GUI currently opens the Isaac Sim Base empty stage because ANYmal C and
  the reference world are PR 14 work.
• First GUI startup can appear temporarily unresponsive while RTX pipelines are
  compiled; the launcher and guide instruct developers to wait and preserve the
  named cache volumes.
• GUI validation is local X11 only; remote streaming is not configured.

Follow-up

PR 14 will add the Isaac Sim x ANYmal C binding, bundled locomotion policy,
sensors, and native Bridge data-plane graphs. PR 16 will complete reset,
readiness, and command safety semantics.