Report shell ACL refusals - #182

Result

• fabric shell now frames a permanent peer ACL denial for the local CLI.
• The refusal returns status 126 and names the peer and shell service.
• Machine-wide shell refusal uses the same named error form.
• Premature shell EOF now reports the peer and service instead of failing silently.
• Transport failures remain on the retry/status path and are not policy refusals.
• Legacy shell/0 drains refusal frames before reporting a stopped send direction.

Tests

• cargo test --locked --lib
• cargo test --locked --test shell -- --test-threads=1
• git diff --check