Add Tirith security scanning to the exec tool, detecting homograph
URLs, pipe-to-shell patterns, terminal injection, typosquatted
packages, and insecure transport before command execution.

- Create tirith_security.py: scanner with auto-install from GitHub
  releases (SHA-256 verified), platform-aware shell mode (posix/cmd)
- Add _tirith_guard() to ExecTool after _guard_command() regex checks
- Add TirithConfig to ExecToolConfig in config/schema.py
- Extend tests/test_exec_security.py with tirith gate + scanner tests

Tirith is already integrated in Hermes Agent
(NousResearch/hermes-agent#1256) and EurekaClaw
(EurekaClaw/EurekaClaw#1). Fail-open by default.

Add Tirith security scanning to the exec tool, detecting homograph
URLs, pipe-to-shell patterns, terminal injection, typosquatted
packages, and insecure transport before command execution.

- Create pkg/tools/tirith.go: scanner with proper *exec.ExitError
  handling, cross-platform auto-install (SHA-256 verified), and
  synchronized first-use installation
- Hook tirithGuard() into shell.go after guardCommand() regex checks
- Add TirithConfig to ExecConfig in config.go + defaults.go
- Cron jobs share the same ExecTool.Execute() path, already covered

Tirith is already integrated in Hermes Agent
(NousResearch/hermes-agent#1256) and EurekaClaw
(EurekaClaw/EurekaClaw#1). Fail-open by default.

Add Tirith security scanning to both shell tool execution and cron
shell jobs, detecting homograph URLs, pipe-to-shell patterns,
terminal injection, and more before command execution.

- Create src/security/tirith.rs: shared async guard with ShellKind
  enum (Native for shell tool, Posix for cron scheduler)
- Hook tirith::guard() into shell.rs after security policy checks
- Hook tirith::guard() into scheduler.rs after command validation
  (cron uses sh -c even on Windows, so ShellKind::Posix)
- Fail-open by default, configurable

Tirith is already integrated in Hermes Agent
(NousResearch/hermes-agent#1256) and EurekaClaw
(EurekaClaw/EurekaClaw#1).

…720acdad

feat(security): add tirith pre-exec command scanning

…roval paths

Runs the external Tirith terminal-security CLI (https://github.com/sheeki03/tirith)
as a pre-exec subprocess on every shell tool call that passes through the
interactive approval paths:

- v1 dispatcher initial path (src/agent/dispatcher.rs)
- v1 thread_ops deferred-replay path (src/agent/thread_ops.rs)
- v2 effect bridge (src/bridge/effect_adapter.rs::enforce_tool_permission)

Block / Warn / WarnAck verdicts (exit 1 / 2 / 3) all surface as approval
prompts with allow_always = false so a finding cannot be permanently
allow-listed. Only Allow (exit 0) skips the prompt.

Fail-closed (safety.tirith_fail_open = false) is a HARD denial, never an
approval — operational failures (missing binary, timeout, spawn error,
unknown exit) map to EngineError::LeaseDenied / PreflightOutcome::Rejected
/ a synthesized deferred-tool error. Encoded via the three-way
TirithPreflightDecision::{Allow, Approval, Deny} enum.

The reason text flows from a new EngineError::GatePaused.reason field
(boxed under clippy's result_large_err threshold) through
ThreadOutcome::GatePaused.reason into PendingGate.description and
EventKind::ApprovalRequested.description. Reasons are sanitized at the
helper level (C0/C1/bidi/zero-width strip + newline collapse) before
leaving tirith_guard.rs so terminal-control payloads tirith was scanning
for cannot reach TUI/SSE/channel surfaces unchanged.

Default-on with fail-open: machines without tirith on PATH see no
behavior change. Tests cover all verdict mappings, alias-canonical
resume safety, approval_already_granted re-scan skip, fail-closed
denial paths, and the sanitizer regression cases.

Coverage in this PR: interactive shell approval paths only. Autonomous
worker / scheduler / routine engine paths and inline ShellTool guard
are explicit follow-ups.

Configuration: safety.tirith_enabled (default true), safety.tirith_bin
(default "tirith"), safety.tirith_timeout_ms (default 5000),
safety.tirith_fail_open (default true). Each setting honors a
SAFETY_TIRITH_* env var with DB-first precedence.

Prior art:
- HKUDS/nanobot#2414 (helper module + ExecTool guard)
- NousResearch/hermes-agent#1256 (helper module + terminal_tool guard)
- NousResearch/hermes-agent#3428 (block AND warn approvable)

…720acdad

feat(security): add tirith pre-exec command scanning

…720acdad

feat(security): add tirith pre-exec command scanning

…720acdad

feat(security): add tirith pre-exec command scanning