AD-502: Add safe shell runtime adapter

[alph-cmky]

Summary

• Adds a Safe Shell runtime adapter implementing the shared RuntimeAdapter contract.
• Allows only configured safe commands by default.
• Rejects arbitrary commands before execution unless allowArbitraryCommands is explicitly enabled.
• Streams stdout and stderr as task events and reports completion/failure events.
• Exports shell adapter APIs from @agentdeck/runtime-adapters.
• Marks AD-502 complete in the development backlog.

Stack

• Stacked on AD-501: Define runtime adapter interface #39 (feat/ad-501-runtime-adapter-interface).

Verification

• TDD red check: pnpm test packages/runtime-adapters/src/execution/shell-adapter.test.ts initially failed because shell-adapter.js did not exist yet.
• pnpm test packages/runtime-adapters/src/execution/shell-adapter.test.ts
• pnpm lint && pnpm format && pnpm typecheck && pnpm test && pnpm build

Closes #15