feat: introduce commandAllow for prefix-based Shell.exec rules

[ysc13245]

feat: prefix-based allowlist for Shell.exec

This PR adds support for commandAllow, enabling prefix-based
allow rules for Shell.exec.

• Avoids regex complexity
• Uses token-based prefix matching
• Applies only when Shell.exec is set to ASK
• Fully backward compatible

Example:

{
  "commandAllow": [
    ["docker", "logs"],
    ["openclaw", "config", "get"],
    ["journalctl"]
  ]
}

This allows common diagnostic commands without interactive prompts,
while keeping other exec calls protected.