feat(guests): cap guest resources and gate boot-start (task 0008)

Give the Host-side placement a `limits` field — `memory`, `cpu`, and
`tasksMax` — that caps the guest's `container@<name>.service` unit via
`MemoryMax`, `CPUQuota`, and `TasksMax`, uncapped by default so an unset
limit contributes no key and systemd keeps its default.

Add an `autoStart` placement option, on by default, driving the
container's boot-start so a Host can define a guest without starting it
at boot.

Give neogaia's skeleton guest modest demonstrative caps.

hosts/neogaia/default.nix

@@ -46,7 +46,13 @@
 
   # The walking-skeleton guest, enabled like any module: proves the guest path
   # end to end through this host's `nix flake check`.
+  # Modest caps keep the skeleton guest from starving the laptop.
   guests.sample.enable = true;
+  guests.sample.limits = {
+    memory = "1G";
+    cpu = "100%";
+    tasksMax = 512;
+  };
 
   modules.agents.claude-code.enable = true;
   modules.agents.tools.gitea-axi.enable = true;