feat: add dedicated log file support

[jy-tan]

Summary

Add a --fence-log-file flag so Fence-owned monitor and debug output can be redirected to a separate file when running fullscreen TUIs, while keeping the sandboxed command's stdout and stderr unchanged.

Resolves #120.

Example usage:

fence -m --fence-log-file ./fence.log -- claude
tail -f ./fence.log

Changes

• Add a shared internal/fencelog logger and route Fence-owned [fence:*] output through it instead of writing directly to process stderr
• Add --fence-log-file to the CLI and propagate the resolved absolute path through helper re-execs
• Truncate the log file once on the initial CLI invocation, then reopen it in append mode for helper re-execs so logs are not wiped mid-run
• Cover the new logging and env propagation behavior with focused tests

[cubic-dev-ai]

No issues found across 18 files