Git-backed file change tracking for sandboxed runs

[muscariello]

• Add snapshot capture to shadictl around sandboxed command execution in crates/shadictl/src/main.rs.

• Detect whether the target working directory is inside a Git repo.

• Record pre-run and post-run Git state:
  - git rev-parse HEAD
  - git status --porcelain
  - git diff --binary
  - optionally untracked file inventory

• Write a session artifact under .tmp or a configurable SHADI runtime directory with:
  - command
  - cwd
  - policy
  - timestamps
  - before/after Git state
  - diff summary

• Expose this with a small CLI UX

• Keep the first iteration read-only with respect to Git history: do not auto-commit, just capture state and diffs.