feat: add isolations primitive to v1 state

[parithosh]

What

Adds a top-level isolations list to the v1 state, alongside partitions and shaping:

{
  "isolations": [
    {
      "name": "blackout-node-1",
      "target": { "node-index": 1, "client-type": "beacon" },
      "scope": ["cl_p2p", "el_p2p", "include_control"]
    }
  ]
}

An isolation cuts every container matched by target off from every other container in the enclave. The counterparty group is computed at apply time as the complement of the target's match set, so it never needs to be enumerated — and the same request keeps working when the enclave topology changes.

Why

"Isolate one node" is listed as a target scenario in the design doc, but partitions can't express it: ResolveGroups rejects overlapping groups and there is no negation selector, so "target vs all" is unwritable. Callers (e.g. assertoor's single-node-blackout playbook, ethpandaops/assertoor#218) had to fake it with two partitions plus client-side enumeration of every other participant.

How

• internal/state: new Isolation{Name, Target, Scope} type; validation rejects missing/"all" targets (isolating everything leaves nothing to isolate from) and enforces the shared name namespace across partitions/isolations/shaping.
• internal/api: resolveIsolations resolves the target, resolves all, subtracts by container ID, and emits a symmetric two-group ResolvedPartition — zero changes to the iptables/conntrack backends, and conntrack teardown comes for free. Clear errors when the target matches nothing or everything.
• Schema (schemas/v1-state.json), --config file loading, ETag, and deep-copy semantics all covered.
• Web UI: isolations table + add modal on the Partitions page (the "all containers" mode is removed from the target picker since it's always invalid), dashboard count card, remove/clear-all wiring, event log detail line.
• Docs: README quick-start example, design-doc API sketch, examples/disruption.yaml.

Testing

• go test -race ./... green; golangci-lint run --new-from-rev=origin/master reports 0 issues.
• New unit tests: validation table cases, JSON round-trip, complement resolution (target vs rest ordering, scope default/override), append-after-partitions ordering, match-nothing / match-everything errors, deep-copy of isolations.

Companion assertoor PR (new run_network_disruption task consuming this): follows separately.

🤖 Generated with Claude Code