feat(apex): observe interactive exec command risk

[kratosboom]

OBSERVATION ONLY
NO ENFORCEMENT
NO APPROVAL CHANGE
NO SANDBOX CHANGE

Why

ApexCode v0.2a adds a bounded, non-authoritative observation layer at the real interactive exec_command boundary. It records risk classification and aggregate category telemetry for dogfood diagnostics while preserving existing Codex execution behavior.

What changed

• Observes the resolved command immediately before UnifiedExecProcessManager::exec_command.
• Classifies shell-wrapped and nested commands conservatively into read-only, write, network, process-control, package-install, Git-mutation, privilege-escalation, or unknown categories.
• Treats unsupported parser states as Unknown.
• Bounds and sanitizes observation fields; no full environment, stdin secrets, file contents, or persistent full commands are recorded.
• Supports explicit stderr diagnostics only when APEXCODE_EXEC_OBSERVATION_DEBUG=1 or true.
• Adds an execution-preservation test proving a normal command result remains available.
• Keeps the observer failure-tolerant and non-authoritative: it cannot change command, cwd, approval, permissions, sandbox behavior, or execution result.

PR #7 is not an ancestor/base requirement. This branch is based directly on the current canonical main.

Validation

Passed:

• Apex runtime-adapter cargo check, test compilation, and Clippy with -D warnings
• Rust formatting checks
• git diff --check

Not completed locally:

• Runtime execution of the adapter/core test binaries and the full core test suites are blocked by the local Windows GNU MinGW linker path configuration. No unexecuted test is claimed as passing; CI or a compatible linker environment should run the full validation matrix.

No safety-kernel files were changed. No production deployment, merge, or force push.