feat: Phase 4 governance/execution slice — PolicyService + ExecutionService

classifyAndGate's decision pipeline moves to core: PolicyService runs the
full gate order (classify + transport escalation, plan-first, syntax,
host-only/host-lxc, VM QGA preflight, dedup, approval-flood, window
routing) over ports.GovernanceStore; ExecutionService records and
dispatches (auto-run via ssh.CommandExecutor + TargetResolver, queue via
ExecutionRecorder) with one converged path for run/docker_exec. Gating
matrix test added (risk x window x declared risk -> outcome); pair
coverage 95.6%.

Bug fix surfaced by the matrix: the flag-space syntax regex was inverted
— it refused valid 'tail -n 3' and missed the actual 'head - n' typo.
Fixed to match dash-space-value only.

Remaining Phase 4 items tracked in the plan: ApprovalService.Decide
convergence, execlog fold, execworker poller. VERSION 0.35.0.

internal/httpapi/api_test.go

@@ -105,7 +105,11 @@ func newTestHandler(t *testing.T, cfg config.Config) http.Handler {
 		&portstest.FakeProvisioner{}, &portstest.FakeResolver{},
 		repo, db.NewRelRepo(pool))
 	seeds := app.NewSeedService(db.NewSeedRepo(pool))
-	return NewHandler(handlerCtx, pool, cfg, app.NewEntityService(repo, onto), repo, db.NewEntityReader(pool), app.NewRelationshipService(db.NewRelRepo(pool), onto), provisioning, seeds)
+	execSvc := app.NewExecutionService(
+		app.NewPolicyService(portstest.NewGovernanceStore()),
+		&portstest.RecordingExecutor{}, &portstest.FakeResolver{Addr: "127.0.0.1"},
+		portstest.NewExecutionRecorder())
+	return NewHandler(handlerCtx, pool, cfg, app.NewEntityService(repo, onto), repo, db.NewEntityReader(pool), app.NewRelationshipService(db.NewRelRepo(pool), onto), provisioning, seeds, execSvc)
 }
 
 // testAuthToken is the static bearer token devConfig() configures. There is