[TASK] CommandRunner protocol + CommandRunnerImpl with allowlist

[kirich1409]

Context

CommandRunner accepts only (tool: String, args: [String]). Impl in private target validates against static allowlist and rejects suspicious tool paths.

Acceptance criteria

• Protocol accepts argv-array, no shell-string.
• Impl allowlist: git, hf, ollama, pod, brew, docker, colima, simctl, xcrun.
• Rejects if resolved tool lives under /tmp, /var/tmp, ~/Downloads, ~/Desktop.

Files to touch (estimate)

best-effort estimate; agent refines during implementation

Implementation notes

• Research report §S8.

Dependencies

None.

Safety checklist

See .github/ISSUE_TEMPLATE/task.yml — tick applicable invariants in the issue if any destructive path is touched.

Definition of Done

• Acceptance criteria satisfied and verifiable
• Tests added or updated
• No build / lint / test regressions
• Self-review against research-report invariants
• Code review approved