build(snap): package ecrou as a strictly confined snap

core26 base, strict confinement, the kvm interface for acceleration
with home and network auto-connected. The runtime needs nothing else:
the host process never mounts a filesystem and never creates or
enters a namespace, so it already lives inside snapd's default-deny
seccomp allowlist. The built .snap artifact is ignored.

.gitignore

@@ -1 +1,4 @@
 /target
+
+# snapcraft build output
+*.snap