M1: Add deterministic command checks with timeouts and modes

[dbrosio3]

Goal

Run deterministic local command checks with explicit timeouts, file scoping, and blocking/warning modes.

User value

Developers get fast, predictable feedback before the push reaches local AI review.

Implementation notes

• Use the command syntax and safety semantics frozen in the M0 schema contract.
• Support {changed_files} or the chosen equivalent without unsafe filename handling.
• Add timeout_seconds, mode: blocking|warning, run: changed_files|always, and fail_fast behavior as defined by the schema.
• Keep the default local budget around 60 seconds if that default is retained in the contract.
• Print concise output with clear next steps and documented escape hatches.

Risks / tradeoffs

• A stricter final command contract may require migration guidance for complex shell-style commands.
• Advanced command forms need explicit safety semantics so file substitution does not reintroduce quoting or eval surprises.

Suggested priority

P0

Milestone

M1: Deterministic local gate

TBD considerations

• Whether command checks use argv arrays, shell strings with explicit semantics, or both under the frozen schema.

Acceptance criteria

• Changed-file substitution is safe under the chosen command contract.
• Timeout failures are clear and deterministic.
• Warning-mode command failures do not block pushes.
• Blocking-mode command failures block pushes.