Define overlapping skill command policy handling

[shiny-code-bot]

Summary

• collect all matching skill command policies and choose a primary match by matcher specificity, matcher width, and stable load/declaration order
• include lower-priority matching policies in guard guidance while de-duplicating repeated preferred actions
• document command policy overlap behavior and canonical ownership guidance for skill authors

Validation

• cargo test -p code-core skills::command_policy -- --nocapture
• cargo test -p code-core --test skill_command_policy -- --nocapture
• exec harness overlap smoke with the freshly built code binary, real repo-local overlapping skill policies, and a fake Responses endpoint: verified the raw command was blocked, overlap guidance was emitted, no exec_command_begin appeared, and the run became quiescent
• ./build-fast.sh
• after merging current origin/main, reran ./build-fast.sh

Closes #244