feat: add allow_exec_sugid config option for setuid binary execution

[Pierozi]

Summary

• Adds opt-in execution of setuid/setgid binaries (e.g., /bin/ps) for MCP servers
• Maintains secure deny-by-default policy while resolving forbidden-exec-sugid violations
• Supports three modes: deny (default), allow all, allow specific paths
• Integrates across config, CLI, profiles, and seatbelt generation

Implementation

Core Types (src/config/schema.rs):

• ExecSugid enum with clean TOML syntax: false, true, or ["/bin/ps"]

Config/Profile System:

• Profile field with last-wins/paths-union merge semantics
• Config merge: project overrides global; paths are unioned
• Merge helper for safe composition

CLI (src/cli/args.rs, src/cli/commands.rs):

• --allow-exec-sugid PATH flag (repeatable, path-based only)
• determine_exec_sugid() with CLI > profile > config precedence
• --explain shows sugid status; --init template includes example

Seatbelt (src/sandbox/seatbelt.rs):

• Rules emitted after (allow signal):
  • Allow(true) → (allow process-exec* (with no-sandbox))
  • Paths → per-path (allow process-exec (with no-sandbox) (literal "..."))
  • Allow(false) → comment only (default deny)
• Full path validation against injection attacks

Test plan

• Unit tests: 8 schema (serde, default, is_default)
• Unit tests: 7 seatbelt (deny, allow, paths, validation, ordering)
• Config tests: 5 (TOML parsing, merge semantics, union merging)
• Profile tests: 4 (compose, last-wins, paths-union, inheritance)
• CLI tests: 2 (single path, multiple paths)
• All 221 tests pass (76 unit + 145 integration)
• Manual verification: dry-run and explain commands work as expected