v0.48.0 — gated shell/exec tool for venice chat (#33)

venice chat --shell — gated shell/exec tool (#33)

venice chat --shell (alias --exec, default OFF) adds a confirm-gated shell tool so the agent can drive gh/git/curl/build/test commands — the same /bin/sh -c rail venice code's run uses (cwd-forced, timeout, size-capped output, VENICE_API_KEY scrubbed from the child env). --shell implies --tools.

Allow/deny policy

Scope it with a single top-level shell config section (shell.allow / shell.deny) — the shared source of truth for both venice chat --shell and venice code's run. --shell-allow / --shell-deny append to it.

• Deny globs match the whole line and each token, are always enforced, and win over allow.
• A non-empty allowlist requires a single simple command (no ; | & < > ( ) \ $) whose leading command is allowlisted — blocks allowed && rm -rf ~`.
• Empty allowlist = unrestricted (confirm gate + deny only); combining that with --yes needs an explicit --shell-unrestricted.
• Not exposed over venice mcp-serve.

Internals

• Exec rails extracted to commands/_exec.py (shared, stdlib-only); venice code's run/git behavior unchanged.
• venice code gains --shell-allow/--shell-deny and honors the same policy, without the auto-run guard (autonomous runs stay non-breaking).

667 tests green.