feat(health_monitor): implement ARM MTE memory provider

[SebStefenel]

Summary

Implements the ARM MTE memory provider requested in #119: ProtectedMemoryAllocator now allocates memory regions protected by the ARM Memory Tagging Extension (MTE). The provider is gated behind the new //config:enable_arm_mte Bazel flag (default: off) and the mte Cargo feature, so users can enable it once the target hardware and OS support it.

Behavior by configuration:

• Flag off (default): regions are plain, zero-initialized, 16-byte aligned memory served by the Rust allocator (portable across Linux and QNX).
• Flag on, aarch64 Linux: regions are mapped with mmap(PROT_MTE), MTE support is detected at runtime (getauxval(AT_HWCAP2)), synchronous tag checking is enabled per thread (prctl(PR_SET_TAGGED_ADDR_CTRL)), and a random non-zero tag is assigned to every 16-byte granule. Allocation fails with MteNotSupported when hardware or OS lack MTE support.
• Flag on, other targets: compiles cleanly, allocation returns MteNotSupported at runtime.

Notes

• ProtectedMemoryAllocator remains a unit struct, so all existing construction sites (builders, tests) are unchanged.
• Monitor builders keep receiving &ProtectedMemoryAllocator unchanged; moving monitor state into protected regions is intentionally left for a follow-up.
• Known MTE limitations are documented in the module docs (16 tags, per-thread tag-check configuration).

Closes #119