test: stabilize machines exec release gate

[andrei-hasna]

Summary

• split the machines exec CLI integration contract into independent per-test cases
• preserve scoped approval, tamper rejection, command failure status, timeout cleanup, and stdin-script coverage
• keep Bun's default 5-second per-test limit unchanged

Root cause

The prior test combined six Bun cold starts and the timeout path's intentional process-group cleanup grace under one 5-second per-test budget. On station load it failed at 5008.45ms, while the same contract completed normally with a finite diagnostic budget and every isolated invocation completed in 338.56-1489.47ms.

Verification

• affected machines exec CLI controls: 6 pass, repeated three times
• bun run typecheck: pass
• bun run verify:release: pass, 573 tests / 0 failures
• shield review: no staged security issues
• gitleaks git --staged --redact=100 --no-banner --no-color .: no leaks

Todos: OPE34-00025 / 6745472c-c5f8-4ed9-a7a4-321271f4035a

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}