security: isolate /exec handler + fix /logs exec-injection properly

[solomon2773]

CodeQL keeps flagging agent-runtime/lib/server.ts:390 (js/command-line- injection at the /exec endpoint). The flag is structurally correct — a shell receives untrusted input — but semantically the feature: /exec IS the designed terminal surface of the agent runtime, and the container sandbox is the isolation boundary, not this code.

Two changes:

1. /logs (line 368) — rewritten from a shell-template execSync to execFileSync with an argv array. 'tail -n ' does not need a shell, and the count is now bounded (parseInt + clamp to [1,10000]) before flowing anywhere. This is a genuine hardening; the injection surface there is gone.

2. /exec — extracted into agent-runtime/lib/execEndpoint.ts as the sole intentionally-shell-executing module, with a header explaining why. .github/codeql-config.yml paths-ignore now excludes that one file so CodeQL focuses on code that SHOULDN'T exec shell commands. The rule keeps firing everywhere else in the repo — no blanket suppression.

Verified: 303/303 backend tests, 6/6 agent-runtime tests, typecheck + eslint + prettier clean.

Summary

• Describe the user-visible or maintainer-visible change.

Validation

• List the commands, tests, or manual checks you ran.

Release And Docs Checklist

• Updated public architecture docs (architecture.md) if this PR changes architecture, deployment topology, component responsibilities, or major data flow.
• If this is a release-prep PR, updated the Reviewed for release: marker in architecture.md.