feat(shell): L3-gated brush as the confined default engine (#1243 Leg 1)

[hartsock]

What this PR does

Promotes brush-ocap from opt-in to the confined default shell engine,
gated on the L3 kernel fence — the first leg of the brush-as-boundary epic
(#1243). "We can't rely on string parsing": the safe-subset static parser
short-circuits at the first denial and refuses $(…)/pipes/subshells, so a
pipelined LLM command (the "10 largest rust files" fuzzer) forces one grant
cycle per program. Brush intercepts at the real spawn primitive (before_exec),
collects all denials in one run, and handles arbitrary shell; newt's gate is
already multi-denial-ready.

• confined_default_engine(l3_active) — brush where a kernel fence
  enforces (landlock/seatbelt); safe-subset's structural $(…)-refusal
  otherwise (without L3, brush would run dynamic constructs advisory-only — a
  honesty regression). Pure; unit-tested without a kernel.
• resolve_shell_engine_choice(...) -> Option<ShellEngine> — Some only
  for a FIXED choice (explicit --shell-engine/[shell] engine, or the
  --full-access auto-upgrade). The CLI publishes NEWT_SHELL_ENGINE only for
  Some, leaving the confined default unpublished so shell_engine()
  resolves it per dispatch against the live fence.
• TOCTOU closed (the mechanized obligation, bridle feat: per-session plan files keyed on conversation id (#220) #239 EnforcementGate.tla):
  the grant-time fence is never cached — bridle_registry() calls
  shell_engine() on every run_command, re-checking ocap_l3_backend() at
  exec time. A fence that drops between grant and exec cannot leave a stale
  brush selection running a dynamic construct advisory.
• resolve_shell_engine retained (delegates → unwrap_or(SafeSubset)) —
  back-compat, existing resolver tests unchanged.
• --full-access keeps the ambient host shell (unchanged).
• doctor now reports the L3-gated confined default resolved for THIS host
  (brush where the fence is active), not a stale hardcoded safe-subset.

Test plan

• cargo test -p newt-core --lib 1558/0, -p newt-tui --lib 530/0; clippy
  --all-targets -- -D warnings + fmt clean.
• New unit tests: confined_default_is_l3_gated (brush iff L3),
  choice_is_none_only_for_the_confined_default (the TOCTOU-closing invariant —
  confined default is None, unpublished).
• Live-verified on gnuc (Landlock active): newt doctor →
  confined default (L2): brush — L3-gated, resolved per run_command (fence active here, …).
• Three disable-ocap FLOOR tests pinned NEWT_SHELL_ENGINE=safe-subset: they
  assert engine-independent floor/bypass logic, and echo is a TRUE bash
  builtin under brush (never spawns → not exec-gated, correctly), which would
  otherwise make them box-dependent.

Out of scope (follow-ups)

• In-brush exec-time sandbox_kind recheck for the advisory-dynamic-
  construct residual (the deeper half of the feat: per-session plan files keyed on conversation id (#220) #239 I4 obligation) — a bridle-side
  hardening in before_exec. Practically, bridle already fail-closes on
  restrict_self NotEnforced for restricted axes, so the window is closed for
  restricted grants; filed separately.
• Brush true-builtin surface audit (echo/printf/test/… bypass
  before_exec because they don't spawn — believed safe since fs/net still hit
  before_open, but deserves an explicit audit) — filed separately.
• Leg 2 (env/token import surface) and Leg 3 (MCP-inside-brush MCP servers must run INSIDE the brush/caveat boundary, not the ambient env #1180).
• The interactive multi-denial UAT (find | sort | head prompts once) — best
  run in the tmux harness; the composition is proven (brush collect-all +
  exec_denial_requests iterate-all).

Part of #1243. Sequencing mechanized by agent-bridle #239.