Summary

• Adds ExecutionContext (named environment, cwd, env_overrides, trusted flag) to ToolCall so each DAG subtask can target a different working directory and env set without restarting the session
• ShellExecutor::resolve_context is the single dispatch chokepoint with explicit precedence: call-site > named registry > skill env > process default
• Speculative cache HandleKey gains context_hash to prevent cross-environment result reuse in parallel subagent scenarios
• validate_sandbox_with_cwd uses ancestor-walk for not-yet-created paths and rejects .. traversal without unsafe std::path::absolute fallback (security fix)
• env_blocklist applied to final merged env for untrusted contexts (prefix-match, not exact-match)
• New [execution] config section with [[execution.environments]] named registry
• 18 unit tests covering resolution precedence, sandbox enforcement, blocklist, trust model

Breaking changes

• AuditEntry::resolved_cwd changed from String to Option<String> with skip_serializing_if — non-shell tool producers now emit null instead of ""

Test plan

• cargo +nightly fmt --check — clean
• cargo clippy --all-targets --workspace -- -D warnings — clean
• cargo nextest run --config-file .github/nextest.toml --workspace --lib --bins — 8719 passed
• Security: path traversal test (allowed/../../etc/shadow rejected)
• Trust: untrusted context cannot bypass blocklist via env_overrides or skill_env
• Cache: parallel tool calls with different execution contexts get isolated cache keys
• Live session: cargo run --features full -- --config .local/config/testing.toml (LLM serialization gate — required before merge per branching.md)

Closes #3572