Add injectable command runner

[tnez]

Context
Panel refreshes and actions need command execution, but shelling out must stay at the edge. See docs/v1-scope.md.

Acceptance criteria

• Define an injectable command runner boundary.
• Unit tests use a fake runner, not real shell commands.
• Real command execution is wired only at the binary/app edge.
• Results distinguish stdout, stderr, exit status, timeout, and launch failure.
• Default timeout is decided and documented before implementation lands.

Out of scope

• Long-running plugin processes.
• Background refresh.
• Shell-specific dashboard logic in core modules.

[tnez]

Implementation is complete in PR #11: #11. I could not close this issue from here because merging PR #11 into main was blocked pending explicit approval for the default-branch mutation. The PR is green and links this issue for automatic closure on merge.