fix(tools): forward checkpoint methods through Arc<ShellExecutor>

[bug-ops]

Summary

• impl ToolExecutor for std::sync::Arc<ShellExecutor> in crates/zeph-tools/src/shell/mod.rs predates the checkpoint feature and only overrode execute/tool_definitions/execute_tool_call/set_skill_env, so checkpoint_undo/checkpoint_redo/checkpoint_list silently fell through to the trait's unsupported default.
• Because agent_setup.rs wraps the shell executor in an Arc before building the executor chain, every checkpoint call resolved against this incomplete impl instead of ShellExecutor's own correct one, so /undo, /redo, and /undo list always reported "Checkpoints are not enabled" in the plain default production wiring — no capability_scopes/shadow_sentinel gating required to reproduce.
• Added the three forwarding overrides (self.as_ref().checkpoint_X(...)), mirroring the existing execute_tool_call forwarding pattern in the same impl block.
• Same defect class as checkpoint_undo/redo/list not forwarded by TrustGateExecutor/PolicyGateExecutor/AdversarialPolicyGateExecutor, breaking /undo in standard production wiring #5899/checkpoint_undo/redo/list not forwarded by ScopedToolExecutor/ShadowProbeExecutor — breaks /undo even after #5899, since these sit outside the gated chain #5905/ScopedToolExecutor does not forward requires_confirmation, defaulting to false for the outermost wrapper #5906, but at the leaf type's own smart-pointer shadow-impl rather than a decorator/wrapper type. Workspace-wide grep confirms Arc<ShellExecutor> was the only active instance of this pattern (a structurally similar but currently harmless case exists in DynSchedulerExecutor, noted below).

Closes #5985

Test plan

• Added arc_wrapped_executor_forwards_checkpoint_methods regression test in crates/zeph-tools/src/shell/tests.rs, constructing a real Arc<ShellExecutor> and calling checkpoint methods through the Arc handle as a dyn ToolExecutor — independently verified by two reviewers to fail pre-fix and pass post-fix (not a false-positive test).
• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins — 12646 passed, 0 failed
• cargo nextest run -p zeph-tools (full crate) — 1355 passed, 0 failed

Follow-ups (not in scope for this PR, to be filed separately)

• DynSchedulerExecutor (src/scheduler_executor.rs:519) is a structurally similar shadow-wrapper pattern — parity-correct today but the same footgun shape.
• Latent P2: capture_snapshot_for silently drops checkpoints for newly-created files under symlinked allowed_paths prefixes on macOS (canonicalize()/absolute() don't resolve /tmp → /private/tmp), only a tracing::warn!, no user-visible error.
• P3 test gap: no existing test covers checkpoint_redo-with-no-prior-undo, checkpoint_list ordering with 2+ entries, or multi-checkpoint undo-stack depth (pre-existing gap, not introduced by this fix).