feat(cmd): add CommandGate for per-command confirmation (#400)

[kke]

Fixes #400

Restores rig v0.x's built-in per-command confirmation as an injectable gate rather than a global. A CommandGate is consulted in Executor.Start, the single chokepoint every Exec/Start/remotefs/service call funnels through, with the fully decorated (sudo-wrapped), PowerShell-decoded, redacted command — so it fires exactly once per command at the outermost runner and can show a human-readable prompt without leaking secrets.

The gate is set once on the Client via WithCommandGate / WithConfirmFunc and propagated to every derived runner (sudo clone, filesystem, services) the same way the logger is injected, avoiding the leaky Runner-wrapper approach that misses the StartProcess chaining path.

Internal privilege-detection probes (sudo/doas availability, UID0 and Windows admin checks) run Ungated so a rejecting gate cannot silently disable sudo instead of surfacing an error.

Adds cmd.CommandGate, cmd.CommandGateFunc, cmd.CommandGateSetter, cmd.ErrCommandRejected, the cmd.Ungated() exec option, and the rig.WithCommandGate / rig.WithConfirmFunc client options.

[Copilot]

Pull request overview

Adds an injectable per-command confirmation mechanism (“CommandGate”) that is consulted at the cmd.Executor.Start chokepoint, enabling a single prompt per fully-decorated command (including sudo wrapping), with support for redaction and an Ungated() escape hatch for internal probes.

Changes:

• Introduces cmd.CommandGate (+ helpers) and wires gate checks into cmd.Executor.Start, returning cmd.ErrCommandRejected on denial.
• Adds cmd.Ungated() and applies it to privilege-detection probes (sudo/doas/uid0/Windows admin checks) to avoid changing detection behavior under a rejecting gate.
• Adds client options rig.WithCommandGate / rig.WithConfirmFunc and tests/examples covering propagation to derived runners (sudo/FS/services) and rejection behavior.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sudo/windows.go	Marks Windows admin probe as Ungated() so confirmation doesn’t alter privilege detection.
sudo/sudo.go	Marks sudo availability probe as Ungated().
sudo/noop.go	Marks UID0/root probe as Ungated().
sudo/doas.go	Marks doas availability probe as Ungated().
example_test.go	Adds an example demonstrating WithConfirmFunc behavior and output.
cmd/runner.go	Adds ErrCommandRejected error sentinel.
cmd/executor.go	Adds gate plumbing to Executor and consults the gate in Start; refactors closer cleanup via closeAll.
cmd/execoptions.go	Adds skipGate option + Ungated() exec option to bypass the gate per-command.
cmd/confirm.go	Introduces CommandGate, CommandGateFunc, and CommandGateSetter API.
cmd/confirm_test.go	Unit tests for gate allow/deny, decoration visibility, and redaction.
clientoptions.go	Adds WithCommandGate / WithConfirmFunc options and stores the configured gate in client options.
client.go	Injects the configured gate into runners that support CommandGateSetter.
client_confirm_test.go	Integration tests verifying gating occurs once per sudo-wrapped command and propagates to derived FS operations.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.