feat: add local exec-policy CLI (#64050)

* feat: add local exec-policy CLI

* fix: harden exec-policy CLI output

* fix: harden exec approvals writes

* fix: tighten local exec-policy sync

* docs: document exec-policy CLI

* fix: harden exec-policy rollback and approvals path checks

* fix: reject exec-policy sync when host remains node

* fix: validate approvals path before mkdir

* fix: guard exec-policy rollback against newer approvals writes

* fix: restore exec approvals via hardened rollback path

* fix: guard exec-policy config writes with base hash

* docs: add exec-policy changelog entry

* fix: clarify exec-policy show for node host

* fix: strip stale exec-policy decisions

src/cli/program/register.subclis.ts

@@ -84,6 +84,11 @@ const entrySpecs: readonly CommandGroupDescriptorSpec<SubCliRegistrar>[] = [
       loadModule: () => import("../exec-approvals-cli.js"),
       exportName: "registerExecApprovalsCli",
     },
+    {
+      commandNames: ["exec-policy"],
+      loadModule: () => import("../exec-policy-cli.js"),
+      exportName: "registerExecPolicyCli",
+    },
     {
       commandNames: ["nodes"],
       loadModule: () => import("../nodes-cli.js"),

src/cli/program/subcli-descriptors.ts

@@ -37,6 +37,11 @@ const subCliCommandCatalog = defineCommandDescriptorCatalog([
     description: "Manage exec approvals (gateway or node host)",
     hasSubcommands: true,
   },
+  {
+    name: "exec-policy",
+    description: "Show or synchronize requested exec policy with host approvals",
+    hasSubcommands: true,
+  },
   {
     name: "nodes",
     description: "Manage gateway-owned node pairing and node commands",