feat: Phase 4 governance/execution slice — PolicyService + ExecutionService

classifyAndGate's decision pipeline moves to core: PolicyService runs the
full gate order (classify + transport escalation, plan-first, syntax,
host-only/host-lxc, VM QGA preflight, dedup, approval-flood, window
routing) over ports.GovernanceStore; ExecutionService records and
dispatches (auto-run via ssh.CommandExecutor + TargetResolver, queue via
ExecutionRecorder) with one converged path for run/docker_exec. Gating
matrix test added (risk x window x declared risk -> outcome); pair
coverage 95.6%.

Bug fix surfaced by the matrix: the flag-space syntax regex was inverted
— it refused valid 'tail -n 3' and missed the actual 'head - n' typo.
Fixed to match dash-space-value only.

Remaining Phase 4 items tracked in the plan: ApprovalService.Decide
convergence, execlog fold, execworker poller. VERSION 0.35.0.

internal/mcp/secrets_tools_test.go

@@ -40,7 +40,7 @@ func (m *mockSecretBackend) Name() string { return "mock" }
 // findToolHandler locates a tool's handler from allTools by name.
 func findToolHandler(t *testing.T, pool interface{}, name string, sec secrets.Backend) func(context.Context, *mcp.CallToolRequest) (*mcp.CallToolResult, error) {
 	t.Helper()
-	for _, r := range allTools(nil, uuid.Nil, sec, nil, nil) {
+	for _, r := range allTools(nil, uuid.Nil, sec, nil, nil, nil) {
 		if r.tool.Name == name {
 			return r.handler
 		}