Report exec policy refusals honestly

[myobie]

Result

• fabric exec now reports every pre-command failure instead of returning silent status 1.
• ACL and machine policy refusals name the peer and exec service and return status 126.
• fabric doctor reports an intentional exec policy refusal as info, with no attention count.
• Unexpected version command failures remain unknown and return status 3.
• Doctor still says an unchecked old peer can force whole-manifest fallback.

Tests

• cargo test --locked --lib
• cargo test --locked --test doctor
• cargo test --locked --test local_slice exec_names_the_peer_and_service_when_the_peer_acl_refuses_it
• cargo test --locked --test shell trusted_peer_without_allow_shell_is_refused
• git diff --check