feat: add secure execution server

[jmgilman]

Summary

• add a one-shot generic capability builder and immutable concurrency-safe server
• execute fresh restricted Starlark programs with cached frozen namespaces and bounded source, steps, time, native calls, depth, and results
• enforce bind-before-authorize-before-dispatch ordering, cancellation gates, panic recovery, and safe public error projection
• generate the Authorizer mock with Mockery and cover builder, execution, cancellation, limits, and concurrency behavior

Verification

• go test ./internal/execution ./... -run 'Cancellation|Cancels|Fresh|Limits|Authorization|Denied|FinalResult' -count=1
• go test ./... -count=1
• go test -race ./... -count=1
• moon run root:lint
• go build ./...
• git diff --check
• independent code review: PASS
• implementation-plan conformance review: PASS