feat: Phase 4 governance/execution slice — PolicyService + ExecutionService

classifyAndGate's decision pipeline moves to core: PolicyService runs the
full gate order (classify + transport escalation, plan-first, syntax,
host-only/host-lxc, VM QGA preflight, dedup, approval-flood, window
routing) over ports.GovernanceStore; ExecutionService records and
dispatches (auto-run via ssh.CommandExecutor + TargetResolver, queue via
ExecutionRecorder) with one converged path for run/docker_exec. Gating
matrix test added (risk x window x declared risk -> outcome); pair
coverage 95.6%.

Bug fix surfaced by the matrix: the flag-space syntax regex was inverted
— it refused valid 'tail -n 3' and missed the actual 'head - n' typo.
Fixed to match dash-space-value only.

Remaining Phase 4 items tracked in the plan: ApprovalService.Decide
convergence, execlog fold, execworker poller. VERSION 0.35.0.

internal/core/ports/governance.go

@@ -95,3 +95,80 @@ type ApprovalRepository interface {
 
 	Decide(ctx context.Context, input ApprovalDecideInput) (domain.Approval, error)
 }
+
+// GovernanceStore is the policy read model: the facts the gating decision
+// needs that live outside the command text — session plan state, assent/
+// destructive windows, duplicate pending executions, and target entity
+// attributes. Implemented by the postgres adapter; faked in portstest.
+type GovernanceStore interface {
+	// SessionHasPlan reports whether the session has any non-replaced plan
+	// step (the plan-first gate). Fails open on store errors — a flake
+	// must not block otherwise-valid work.
+	SessionHasPlan(ctx context.Context, sessionID string) bool
+	// AssentWindowActive reports a live operator-assent grant for this
+	// agent+session (config_mutation auto-run scope).
+	AssentWindowActive(ctx context.Context, agentID domain.UUID, sessionID string) bool
+	// DestructiveWindowActive reports a live explicitly-confirmed
+	// destructive grant for this agent+target+session.
+	DestructiveWindowActive(ctx context.Context, agentID domain.UUID, targetSlug, sessionID string) bool
+	// PendingApprovalCount counts this session's executions stuck at
+	// pending_approval (the approval-flood gate).
+	PendingApprovalCount(ctx context.Context, sessionID string) int
+	// PendingDuplicate returns the execution id of an identical command
+	// already queued for approval on this target, if any.
+	PendingDuplicate(ctx context.Context, targetID domain.UUID, action string) (domain.UUID, bool)
+	// EntityAttributes loads one entity's attributes map (VM QEMU-guest-
+	// agent state and similar gating inputs).
+	EntityAttributes(ctx context.Context, targetID domain.UUID) (map[string]any, error)
+}
+
+// CreateRunInput records one `run` submission in the execution ledger:
+// the execution entity + row, its graph edges, the classification
+// decision, and the audit entry — one transaction. Written before the
+// route executes (auto-run or queue), exactly as the pre-service
+// classifyAndGate path did.
+type CreateRunInput struct {
+	ExecutionID    domain.UUID
+	TargetID       domain.UUID
+	TargetSlug     string
+	AgentID        domain.UUID
+	SessionID      string
+	Command        string
+	Purpose        string
+	Action         string // "run:{json params}" action column value
+	RiskClass      string
+	Route          string // "auto-act" | "escalate"
+	ClassReasoning []byte
+	CorrelationID  string
+}
+
+// QueueApprovalInput records the operator-approval ask for a gated
+// execution: the approval row, the execution status flip, and the
+// session's awaiting_input transition (with its task.status event).
+type QueueApprovalInput struct {
+	ExecutionID domain.UUID
+	TargetID    domain.UUID
+	TargetSlug  string
+	Action      string
+	Params      string
+	RiskClass   string
+	SessionID   string
+}
+
+// FinalizeExecutionInput closes an auto-run execution with full timing.
+type FinalizeExecutionInput struct {
+	ExecutionID domain.UUID
+	Status      string // "completed" | "failed"
+	Result      []byte
+	StartedAt   time.Time
+}
+
+// ExecutionRecorder persists the run-submission lifecycle. The service
+// owns ordering and the decision; the adapter owns the SQL (entity row,
+// executions row, edges, classifications, approvals, audit, events).
+type ExecutionRecorder interface {
+	CreateRun(ctx context.Context, input CreateRunInput) error
+	MarkRunning(ctx context.Context, executionID domain.UUID) error
+	Finalize(ctx context.Context, input FinalizeExecutionInput) error
+	QueueApproval(ctx context.Context, input QueueApprovalInput) error
+}