test(enterprise): verify runtime isolation checklist

[Gracker]

Summary

• Add a stable TypeScript contract for all 15 README §11.11 runtime-isolation vulnerability rows.
• Add a Jest evidence test that checks README coverage, evidence files/patterns, and the checklist doc.
• Document the runtime isolation checklist and mark §0.4.12 complete while keeping §0.4.3 RSS benchmark open.

Validation

• cd backend && npx jest --runInBand src/scripts/__tests__/enterpriseRuntimeIsolationChecklist.test.ts
• cd backend && npm run typecheck
• git diff --check
• npm run verify:pr