research: optional real kernel or VM backend outside the core bundle

[keys-i]

FreeBSD and Linux profiles are identities and command sets, not kernels. A real kernel requires a separately sandboxed VM backend.

Acceptance criteria:

• Compare an iframe or worker VM, WASI component, and remote-session adapter against the existing custom-command boundary.
• Threat-model isolation, networking, persistence, resource caps, and termination.
• Measure cold bytes, startup time, idle memory, and command latency.
• Keep the backend optional and separately loaded; the core bundle must not pay for it.
• Reject the feature if it cannot provide materially more fidelity than registered commands within an acceptable browser budget.