docs(infra): design Compass self-host runner + adoption strategy (RIG-3070)

docs/designs/DECISIONS.md

@@ -145,6 +145,7 @@ check enforces the mechanical half. Full rationale:
 | DL-288 | The profile's model axis resolves through the RIG-1715 LLM gateway (single egress; agents hold no provider creds) and REFERENCES the RIG-2845 role taxonomy + stable-name routing policy — this record delivers per-Manager profile selection + propagation, RIG-2845 owns the policy the model fields name, and RIG-1716 is where the deferred extensions axis will resolve | Active (Matt, 2026-08-29) | [per-Manager profiles §Adjacency](agent/compass-per-agent-overrides/design.md#adjacency-compose-do-not-duplicate) |
 | DL-289 | The agent-facing spawn path may carry `profile` — a Manager may select its subtree's profile (RIG-2937 ruled YES, unconditional): no selectable-set policy, no cross-family conditioning (cross-family stays an advisory `profiles/` PR-review check, not a door lint); the oversight-degradation-by-composition residual risk is accepted; owner-fence and set-at-creation-only are unchanged | Active (Matt, 2026-08-29) | [per-Manager profiles §Two-layer contract](agent/compass-per-agent-overrides/design.md#the-two-layer-contract-reframed-at-profile-granularity) |
 | DL-290 | A profile-named model that fails registry resolution FAILS LOUD on ALL sessions (every session carries a profile; `default` included) — the spawn fails with a frame-visible error (the Manager belt `cli.ts:991-1005` fires on `session.model === undefined`); a model that resolves but has no working auth fails loud as a frame-visible HARD error (at spawn if T6 auth-pre-flights the pinned model, else at first turn), never a silent substitution. Compass never relies on the SDK's built-in silent auth-fallback substitution | Active (Matt, 2026-08-29) | [per-Manager profiles §T6](agent/compass-per-agent-overrides/design.md#t6--agent-profile-resolution--model-stack-render) |
+| DL-318 | The runner end state splits by trust model (RIG-3070): untrusted multi-tenant operation requires the microVM hardware boundary (KVM, unchanged); self-host single-tenant deployments keep podman as a permanent, supported entry tier requiring no `/dev/kvm`, with microVM the recommended (not required) upgrade for defense-in-depth or an operator running untrusted code. When and how a hosted multi-tenant service sequences its move to microVM-only is a managed-plane rollout decision, out of scope here. AMENDS the frozen KVM-only amendment (`microvm-kvm-only-amendment.md:96-97`, "A KVM-absent host does not get a lesser boundary; it does not run") with a self-host carve-out, RATIFIES DL-259 (KVM stack); the `ContainerRuntime` interface stays frozen; DL-235's client-only charter is REVERSED by DL-319 (the compass-native embedded-mode-revival record, `ui/compass-native-embedded-revival/design.md`), which carries this record's trust-model rationale, and this record does not itself alter compass-app architecture | Active (Matt, 2026-08-31) | [runner topology & adoption §The ruled topology](infra/runtime/compass-runner-adoption-strategy/design.md#the-ruled-topology-ratifies-dl-259-records-the-deferred-reversal-of-dl-235-amends-the-kvm-only-amendment-for-self-host) |
 
 ## Comms & tools