Require opt-in to run operator terminal commands on the host

[aditya-786]

Summary

Closes #1347.

The operator's terminal action runs whatever command the model emits. With the docker provider this runs inside a container (bash -c ...), but with the default local provider it ran on the host via subprocess.run(command, shell=True) with no gating. A prompt-injected model could therefore execute arbitrary commands as the Khoj process user, and _execute_shell_command returned success with no log, so it happened silently.

This gates host execution of the terminal action behind an explicit opt-in:

• Host (local provider) terminal commands are refused unless KHOJ_OPERATOR_ALLOW_LOCAL_SHELL=true is set, via a new is_operator_local_shell_allowed() helper that mirrors the existing is_operator_enabled().
• The docker provider is unchanged; commands stay sandboxed in the container.
• When a host command does run, it is logged with logger.warning so execution is no longer silent.

Execution is otherwise unchanged; this only adds a default-safe gate around the host path, extracted into _run_terminal_command so it is easy to test. The text_editor_* actions build their own commands with quoted paths and are out of scope here.

This is the minimal default-safe mitigation. If you would prefer a different posture, for example an interactive confirmation step or restricting the operator to the docker provider entirely, I am happy to adjust.

Test plan

• tests/test_operator_computer.py: _run_terminal_command refuses on the host by default (the executor is not called), runs when KHOJ_OPERATOR_ALLOW_LOCAL_SHELL=true, and is ungated for the docker provider.
• tests/test_helpers.py: is_operator_local_shell_allowed() env var behavior.