interp: add CommandObserver option for per-command observation

[matt-dz]

Summary

Adds a new public CommandObserver RunnerOption that fires once per simple command dispatch, exposing the resolved command name, args, exit code, status, source position, and duration.

Motivated by internal telemetry work in the Datadog Agent's Private Action Runner (design doc): the Agent needs to emit one APM span per rshell command so Datadog engineers can see which builtins customers actually use, which they try but aren't implemented, and which the allowlist blocks.

API

type CommandStatus string
const (
    CommandStatusOk         CommandStatus = "ok"          // dispatched to a builtin; ExitCode is real
    CommandStatusNotAllowed CommandStatus = "not_allowed" // rejected by AllowedCommands; ExitCode is -1
    CommandStatusUnknown    CommandStatus = "unknown"     // no rshell builtin; noExecHandler refused; ExitCode is -1
)

type CommandEvent struct {
    Name     string
    Args     []string
    ExitCode int
    Status   CommandStatus
    Pos      syntax.Pos
    Duration time.Duration
}

type CommandObserverFunc func(ctx context.Context, event CommandEvent)

func CommandObserver(fn CommandObserverFunc) RunnerOption

Wired into the single dispatch point at interp/runner_exec.go:call, so it fires for every path (builtin execution, allowlist rejection, unknown command).

Follow-up

Tag v0.0.11 after merge so the datadog-agent can bump.

[matt-dz]

Closing in favor of @julesmcrt's #186 which covers this and more (pipeline/for/if structural spans, self-contained tracer to org2). We opened these in parallel 5 hours apart — didn't spot his until afterwards. Will rebase our Agent-side trace-context-bridging PR (datadog-agent#49482) onto #186 once it lands and v0.0.12 ships.