feat(cmd): launch terminal commands under entry-declared security context

[wolfy-j]

Problem

Strict security mode exposed that CLI terminal commands start without the actor and policy scope declared for that command. Security checks then deny because the process frame is incomplete.

Change

A command can declare its launch security context in meta.command.security:

meta:
  command:
    name: test
    security:
      actor:
        id: app:runner
        meta:
          tenant: acme
      policies:
        - app:runner_policy

• Command metadata is decoded into the existing typed security.Config; actor metadata is preserved and malformed known fields are rejected.
• system/security.ResolveConfigPairs is the single resolution path used by both WithSecurityConfig and terminal command launch.
• Resolution preserves an inherited actor when none is declared and merges declared policies into an inherited scope.
• The CLI attaches the resolved actor and scope to process.Start.Context, which the terminal host applies to the process frame.
• Missing registries, policies, groups, malformed declarations, and entry lookup failures abort launch before the process manager is called.

WithSecurityConfig remains a compatibility wrapper: it applies all successfully resolved pairs and retains its existing tolerant behavior for unresolved references.

Security boundary

The declaration lives under meta.command, so it is honored only by the trusted CLI terminal-launch path. Ordinary process spawns do not consume it. Entries without the declaration retain their existing behavior.

Verification

• Typed metadata tests cover actor metadata, policy/group IDs, malformed fields, empty declarations, and forward-compatible unknown fields.
• Resolver tests cover missing registries/references, actor inheritance, scope merging, and transport into the same frame shape used by the terminal host.
• Launch tests prove invalid declarations fail before process-manager startup.
• go test ./..., targeted race tests, and linters for the changed packages pass locally.