refactor(tools): migrate Arc<ShellExecutor> to DynExecutor erasure path

[bug-ops]

Summary

• Removes the hand-maintained impl ToolExecutor for Arc<ShellExecutor> in crates/zeph-tools/src/shell/mod.rs, a bespoke forwarding wrapper structurally identical to the DynSchedulerExecutor anti-pattern removed in refactor(scheduler): route DynSchedulerExecutor through DynExecutor erasure path #6223.
• The shell executor's production composition slot (src/agent_setup.rs) now wraps it as zeph_tools::DynExecutor(Arc<ShellExecutor>), flowing through the existing ErasedToolExecutor erasure adapter, which forwards all 13 ToolExecutor methods by construction instead of by hand.
• Removing the wrapper exposed a real, previously-masked gap: impl ToolExecutor for ShellExecutor itself never overrode execute_confirmed (only execute). The old code was accidentally correct only because the deleted wrapper's override called self.as_ref().execute_confirmed(...), which Rust's inherent-method-priority rule silently resolved to ShellExecutor's separate inherent execute_confirmed method rather than the trait method. Once routed through DynExecutor's dynamic dispatch, that accidental shadowing no longer applies, and the trait's default (self.execute(..), no confirmation bypass) would have kicked in — reintroducing CompressedExecutor/ToolFilter/Arc<ShellExecutor>-style shadow-impls have the same ToolExecutor forwarding gap as #5900/#5938/#5931 #6012. Fixed by adding an explicit execute_confirmed override on ShellExecutor forwarding to the same execute_inner(response, true) the inherent method already uses.
• Independently verified (developer, critic, and tester passes) that this gap is not reachable from the live agent turn loop today — only the structured execute_tool_call(_confirmed) path is used in production; the string-response execute/execute_confirmed path is otherwise dead code. The fix is still required for the refactor's own "behaves identically" contract and closes the gap for any future/erased caller.
• shell_executor_handle (used only for TUI background-run metrics via the concrete ShellExecutor::background_runs_snapshot() inherent method) is unaffected.
• 3 regression tests in crates/zeph-tools/src/shell/tests.rs renamed from arc_shell_executor_* to dyn_executor_* and adapted to exercise the same invariants (CompressedExecutor/ToolFilter/Arc<ShellExecutor>-style shadow-impls have the same ToolExecutor forwarding gap as #5900/#5938/#5931 #6012, checkpoint_undo/redo/list never reach ShellExecutor — Arc<ShellExecutor>'s own ToolExecutor impl doesn't forward them #5985) through the new DynExecutor-wrapped path.

Closes #6224

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins — 13453 passed, 35 skipped
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace --features "desktop,ide,server,chat,pdf,scheduler"
• Verified the adapted dyn_executor_execute_confirmed_bypasses_confirmation regression test genuinely fails without the execute_confirmed fix (reverted locally, confirmed failure, restored)
• Confirmed no other Arc<ShellExecutor> production call site depends on the removed impl (only production site was agent_setup.rs, now migrated)
• Confirmed no other ToolExecutor implementor shares the same execute_confirmed override gap