OIC execution policy for agent tools and CI runs #231

Context

An agent may decide to run a test, a script, or a CI workflow to check a claim. OIC must allow that only within explicit policy. Related: #161 (sandboxed test runs for reviews).

Behavior to implement

• Policy config: allowlisted commands and workflows, repo and environment scope, timeouts, resource limits, network policy, secret handling, read-only by default, and approval required for write or risky actions.
• No unrestricted production credentials are given to the agent by default.
• Every execution is stored as evidence with: command or workflow ID, repo and commit SHA, environment, parameters, start and end time, exit status, and log or artifact references.
• Every action is written to the audit trail: who started it, which runtime, which tools.

Acceptance criteria

• A command outside the allowlist is refused, and the refusal is recorded.
• A write-capable action waits for approval.
• Secrets never appear in logs, events, or checkpoints (reuse the redaction from ADR 0006).