docs: specify command execution as two tiers - #565

A command is an argv vector. A script is a file that an argv vector runs. No third thing, and in particular
no command string assembled by concatenation and handed to an interpreter's -c.

docs/architecture/6.3-command-execution.md, with its status companion, indexed after 6.2.

Why now

Three places build command strings by concatenation, and each is exploitable, broken, or both:

• pkg/platform — 70 concatenating call sites reaching sudo -n bash -c, with ParsePURL applying no charset
  validation and decoding %3B to ;
• shell.exec / powershell.exec — both take an opaque string, with different escaping dialects, so one
  quoting helper cannot serve both
• two test fixtures interpolated a native path into an sh -c string, where Windows backslashes were consumed
  as escapes

The two tiers

Tier 1 is exec.Command with an argv vector. All 70 platform commands fit, once two habits are unlearned:
a format string quoted only to hide it from sh is a plain argument, and a pipe whose right-hand side is a text
utility is a Go expression — | grep is strings.Contains, | wc -l is a line count.

Tier 2 takes a script string, writes it to a file, and runs it through tier 1. Pipes, loops and redirects
work because they're script content.

Tier 2's body stays static; values arrive as $1, $2. This is the half that makes it safe rather than
merely tidier — interpolating into the body would relocate the escaping bug, since script text is still shell
source. It also means no quoter is needed in either dialect.

Two details worth the review

• The temp file goes in the scratch root, not os.CreateTemp — confinement, self-removing lifetime, and the
  restrictive mode a script carrying a secret needs on both platforms. The executable bit is never set; the
  interpreter is named explicitly.
• Result.Command carries the argv vector for tier 1 and the script source for tier 2. Never the temp
  path, which is unauditable once scratch is reclaimed; never a joined string, which isn't what the kernel
  received.

Open

Five questions are recorded rather than assumed. The sharpest: does shell.exec(command=…) survive? It's the
only shape requiring escaping, so keeping it keeps the defect class alive, and retiring it breaks an authoring
surface.

#561's pkg/platform rewrite is tier 1 and can proceed as the first delivery without waiting for the
tiers to be built.

Refs #561.