Add isolated context mode: CPython in a child OS process

[benoitc]

Adds mode => isolated: the Python interpreter of a context runs in a child OS process. worker and owngil are unchanged.

The goal is a mode where Python code cannot take the node down or run forever, without giving up the C extension ecosystem. The embedded interpreter cannot offer that: an interrupt only lands at the next bytecode, memory cannot be capped soundly, and a segfault in any extension kills the VM. A child process gets all of it from the OS: a signal lands wherever the child is, SIGKILL is the backstop, rlimits and cgroups bound it, and a crash costs one child, which is restarted within a budget.

The child is driven over a Unix socket with the framing of the existing callback pipe, and needs no native code on the Python side, only a small ETF codec with the NIF's type mapping. The public API is the same; where the child cannot match an embedded behaviour it fails loudly instead of diverging. The context process is a gen_statem that serves one caller at a time and lets callbacks re-enter, and a timeout cancels only its own request. On macOS the child enforces the memory limit itself, since the kernel ignores RLIMIT_AS; the cgroup option is refused outside Linux. Listen sockets are handed to children over the control socket, so the worker loop shape works out of process.

The cost is about 10 us per call over worker mode, one process per context, and payloads copied through the socket. Shared memory through erlang-iommap is left for a follow-up.

Validated on macOS and FreeBSD. Guide: docs/isolated.md. Version 4.2.0.