feat(shell): argv + safe-subset engine, increment 1 (#34)

[hartsock]

Implements increment 1 of #34 (ADR 0005 D3): replaces the fail-closed shell stub with the argv + safe-subset engine. agent-bridle is the exec funnel — it parses the request itself, checks the leash, and spawns directly. L2 convenience; the L3 boundary stays deferred (#35), so runs are honestly advisory (sandbox_kind: none, ADR 0005 D1).

What

• parse.rs — the safe-subset classifier: quote-aware tokenizer → a single command's argv. Refuses $(...)/backticks/subshells by design (Dynamic); refuses |, &&, ||, ;, <, >, globs, $VAR as Unsupported (later increments); Malformed for bad input.
• shell_tool.rs — program+args or cmd; exec/cwd leash checks; direct spawn (std::process in spawn_blocking) with capture + timeout; structured denied envelopes.
• lib.rs / Cargo.toml — de-stubbed; documented as the engine; brush kept as the deferred reversible engine (brush-bridle-core: optional full-bash shell engine (deferred, reversible — not the path to a usable shell) #20).
• mcp consumer tests — restored from stub-shims to assert real behavior (success + in-band denial).

Scope (this increment)

Single command with quoted args. Pipelines / redirections / && / globbing follow as separate increments on #34.

Test plan

just check green (fmt + clippy all-features & no-default-features + workspace tests). Security keystones covered: echo "a|b" is a literal arg; $(...) is refused and never runs; a refused pipeline means the downstream rm never executes; out-of-scope exec → structured denial; MCP boundary surfaces denials in-band.

Part of #34.

🤖 Generated with Claude Code