feat(pipeline): centralize bounded process execution

[szmyty]

Summary

Centralizes external tool execution behind one bounded, policy-aware process port and migrates the production wrapping paths tracked by #356.

Canonical process execution

Adds public renderflow::process primitives for:

• direct executable + argv execution with no implicit shell interpretation
• explicit shell classification and direct-shell rejection unless opted in
• working directory and stdin/stdout/stderr modes
• filtered environment inheritance with explicit allow/deny/override behavior
• default and per-request timeouts
• synchronous cancellation tokens
• process-tree termination where supported
• independently bounded stdout/stderr capture with truncation evidence
• expected file/directory output validation
• structured exit/timing/platform evidence
• bounded --version probes
• secret-bearing argument/environment redaction
• declarative network/sandbox policy hooks without false enforcement claims

Process-tree behavior

• Unix children run in their own process group; timeout/cancel sends group SIGTERM, waits a bounded grace period, then escalates to SIGKILL.
• Windows attempts taskkill /T /F and falls back to direct-child termination.
• Unsupported platforms retain explicit direct-child fallback evidence.

Migrated production paths

• generic adapters::command::run_command
• YAML CommandTransform
• command-backed collection/aggregation transforms
• dependency availability checks
• Tectonic/PDF probing
• renderflow doctor tool probes
• plugin required-tool probes

Existing Pandoc, FFmpeg, HTML, DOCX, audio, and image rendering already flow through run_command, so they inherit the canonical executor through the adapter migration.

The historical repository-audit command still uses date/git only for its own report metadata. It is not a transform/tool adapter and is documented as outside this reusable execution-provider boundary.

Security and diagnostics

• default environment strips credential-looking variable names unless explicitly allowed/set
• sensitive argv/env values are hidden from Debug, tracing, and checked-execution errors
• bearer tokens and URL authority credentials receive defense-in-depth redaction
• raw captured bytes remain available explicitly but are never included directly in Debug
• a child that exits 0 but fails declared output validation is not considered successful

Tests

The process module includes fixtures for:

• missing executable
• non-zero exit
• timeout
• cancellation with descendant-process termination on Unix
• oversized stdout capture and explicit truncation
• secret redaction
• missing expected output
• direct shell rejection
• sensitive environment-name filtering
• bearer/URL credential redaction
• bounded tool version probing

docs/process-execution.md documents the execution/security contract and Linux/macOS/Windows behavior.

Architecture boundaries

This PR intentionally does not:

• introduce Tokio/async process execution
• define the full runtime tool capability registry or toolchain fingerprint (Create a runtime tool capability registry and reproducible toolchain fingerprint #359)
• make execution-result provenance complete (Make execution results provenance-complete and align artifact evidence with Flow contracts #355)
• wire Flow resume/orchestration semantics (Add checkpointed execution and a resumable Renderflow provider seam for Flow #358)
• implement a network sandbox merely because a request declares network intent

Validation

Final head: f1b88a267b3bb8c7fc96f58863bcca7d37c119da

All final-head workflows are green:

• CI run 33433271956
  • Clippy with warnings denied and no lint allowances
  • Rust workspace build and full test suite
  • process timeout, cancellation/process-tree, bounded capture, redaction, expected-output, missing executable, non-zero exit, shell opt-in, environment filtering, and tool-probe fixtures
  • web frozen install, format, lint, typecheck, tests, build, and artifact upload
  • AUR stable and git package validation
  • portable installer release-build/install smoke test
  • Snap build, classic install, renderflow --version smoke test, and artifact upload
  • bundled dry-run, library embedding, and plugin registration examples
• Docs run 33433271935
  • generated-doc regeneration and zero-diff verification
  • MkDocs build
  • versioned docs smoke build
• Commit Lint runs 33433271840 and 33433810986

The final PR contains one Conventional Commit, contains no temporary validation workflow or lint suppression, and is mergeable.

Closes #356

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress