Report approved command launch failures accurately

[morgaesis]

Approved commands can fail during launch and still appear as policy denials. This change separates policy decisions from execution outcomes, applies working-directory access under the intended child identity and capabilities, and retains child ownership through runtime registration and cleanup. Typed outcomes preserve unknown start state and execution failures across approval, rollback, audit and session history. Upgrade the daemon and clients together; schema 15 requires a matching pre-upgrade snapshot for rollback. See the upgrade and rollback contract.

[postil-dev]

review incomplete · 1 advisory finding open
1 finding posted inline

1 suppressed

• Release registered ownership when spawn fails at src/server/runtime.rs:780: cites a line the named construct does not sit on; severity warn, confidence 0.94. prepare registers a state whose pending_launch flag remains true until adopt runs. If the subsequent spawn fails, the state is still held by the cleanup worker, cleanup_tick never considers it complete, and any secret_files lease remains retained indefinitely. Make failed launch handling clear the pending state and release the lease, or unregister the state before propagating the spawn error.

_{Review details}