Phase 3a: decouple ProcessContainer backend selection from schema version

[MGudgin]

• I have signed the Contributor License Agreement.
• This pull request is related to an issue.
• If this PR changes build commands, project architecture, or key conventions, I have updated .github/copilot-instructions.md.

---

Stacked PR. Base is user/gudge/versioning_phase2_5_state_aware_conformance (Phase 2.5), not main. Review/merge 2.5 first; this branch will be retargeted to main once 2.5 lands.

Summary

Phase 3a of the versioning remediation. It decouples the Windows ProcessContainer AppContainer-vs-BaseContainer choice from the config's schema version, making backend selection purely host-capability driven: BaseContainer is preferred when the OS supports it, AppContainer is the downlevel fallback. The schema version no longer changes runtime backend selection, and --experimental no longer influences the AC/BC choice (it still gates the other experimental backends/features). This is the foundation for Phase 3b (raising the schema floor and retiring 0.4.0/0.5.0).

Details

• Executor binary (src/core/wxc/src/main.rs): route ProcessContainer unconditionally through dispatch_with_fallback (already capability-driven, prefer_bc=true); delete the version/experimental gate and the else plain-AppContainer arm.
• SDK streaming (src/core/mxc-sdk/src/dispatch.rs): select the backend with a direct fallback_detector::is_base_container_usable() probe — the same probe the dispatcher's Tier 1 selection uses, so the binary and streaming paths agree. Semantic shift (intentional): streaming on a non-BaseContainer host now gracefully uses AppContainer instead of fail-closing.
• Delete is_base_container_version + BASE_CONTAINER_MIN_VERSION and their unit tests (src/core/wxc_common/src/config_parser.rs).
• Reword now-stale hints/comments that told users to use schema 0.4.0-alpha to fall back to AppContainer (base_container_runner.rs, launch_diagnostics.rs, appcontainer_runner.rs, models.rs ContainmentBackend doc, mxc-sdk policy.rs).
• Reframe the mxc-sdk sandbox.rs integration tests that used the policy version to select the tier as backend-agnostic ProcessContainer regression guards.

Behavior note: this only changes configs that previously took the plain-AppContainer path (schema < 0.5 without --experimental); every config that already satisfied experimental || version >= 0.5 already routed through the capability-driven dispatcher and is unaffected. Those legacy configs are retired in Phase 3b.

Tests

• cargo test -p wxc_common -p mxc-sdk (357 + mxc-sdk pass).
• cargo clippy --workspace --all-targets -- -D warnings; cargo fmt --all -- --check.
• check-schema-codegen.js and check-sdk-types-codegen.js both green (no wire change).

Microsoft Reviewers: Open in CodeFlow