docs(rfc): RFC 0012 Isolation Backend interface

Introduces RFC 0012, the runtime-selectable Isolation Backend contract: a
pluggable component that establishes and enforces an agent's isolation
boundary across network, filesystem, syscall, and identity, while the
supervisor stays the policy authority (proxy, policy, audit) and the agent's
only egress.

Includes the supporting topology matrix and codebase-grounding notes.

Signed-off-by: Jordan Ganoff <jordan.ganoff@docker.com>

Author: jganoff