)

Seventh PR in the 12-PR file-policy rollout. Adds three xtask
subcommands that share the same finding model and modes as
check-file-policy but operate over different universes and ledgers.

## Commands

- `cargo xtask check-generated --mode <mode>`
    validates policy/generated-allowlist.toml. Universe is "entries
    only" — the allowlist is itself the declaration of what is
    generated, so there is no "unreceipted generated file" finding.
    Unused detection still runs against all tracked files so a glob
    like `**/*.snap` is correctly flagged "used" if real snapshots exist.

- `cargo xtask check-executable-files --mode <mode>`
    inspects tracked files with the git executable bit (`100755` per
    `git ls-files --stage -z`) and reconciles them against
    policy/executable-allowlist.toml. This is the only check whose
    universe is determined out-of-band (the git bit), so unreceipted
    findings are genuine "executable but not receipted" warnings.

- `cargo xtask check-dependency-surfaces --mode <mode>`
    reconciles Cargo.toml, Cargo.lock, deny.toml, crates/*/Cargo.toml,
    and fuzz/Cargo.* against policy/dependency-surface-allowlist.toml.

## Shared model

All three commands and check-file-policy now share the same:
- Mode enum (advisory | blocking-allowlist | blocking-strict)
- Finding shape (unreceipted, missing_fields, expired, stale, unused)
- Report format (target/policy/<name>-report.{md,json})
- Required-field validator (extended with generator + regen_command
  for the generated set)

The Find/match split between `receipt_universe` and `match_universe`
keeps EntriesOnly behavior correct: the receipt universe is empty so
no unreceipted findings fire, but the match universe is the full
tracked-file set so unused detection works on patterns.

## Acceptance

- cargo check --workspace --locked passes.
- cargo clippy -p xtask --all-targets --locked -- -D warnings clean.
- cargo fmt --all -- --check clean.
- Live results on current main:
    check-generated:           generated=0  entries=1 unreceipted=0 missing=0 expired=0 stale=0 unused=0
    check-executable-files:    files=0      entries=0 unreceipted=0 missing=0 expired=0 stale=0 unused=0
    check-dependency-surfaces: dep_files=16 entries=4 unreceipted=0 missing=0 expired=0 stale=0 unused=0

## Out of scope

- check-workflow-surfaces, check-process-policy, check-network-policy
  (PR 8 / #207)
- Unified policy-report (PR 9 / #208)
- CI wiring (PR 10 / #209)
- DRY-up of the duplicated workspace_root / today_iso / git ls-files
  helpers across the three checker modules (intentional follow-up
  after the ladder lands).

Closes #206.