Summary

• Adds execute_confirmed_blocked_command_rejected test in crates/zeph-tools/src/shell.rs
• Uses sudo id (blocklist-only, no confirm-pattern overlap) to unambiguously assert ToolError::Blocked is returned when calling execute_confirmed() with a blocked command
• Covers the code path verified in fix(tools): enforce shell blocklist before permission policy check #1529 where find_blocked_command() runs before the skip_confirm guard

Closes #1530.

Test plan

• cargo nextest run -p zeph-tools --lib — 657 tests pass
• cargo +nightly fmt --check — OK
• cargo clippy --workspace --features full -- -D warnings — no warnings
• Full suite: cargo nextest run --workspace --features full --lib --bins — 5182 tests pass