fix(sandbox): parse launcher option arity

[gouhongshen]

Summary

Follow up on #696 by closing a destructive-command policy bypass discovered during the synchronized main review in #697.

The transparent-launcher resolver previously treated every unrecognized option as a flag without a value. For example, exec -a alias dd ... therefore misidentified alias as the executable and failed to classify the real dd invocation.

This change:

• gives each supported launcher (command, builtin, exec, nohup, env, sudo, doas, and pkexec) an explicit short/long option grammar and value arity;
• locates the executable after known value-bearing options and short-option clusters;
• fails closed when option arity or a split command form such as env -S cannot be proven;
• resolves child executables dispatched through timeout, nice, ionice, and setsid, with explicit option/value grammar and timeout duration handling;
• adds owner-level and public execute_bash validator coverage for destructive and benign cases.

Related issue

N/A — follow-up to merged PR #696 and synchronized review fix from #697.

Change type

• Feature
• Bug fix
• Documentation
• Refactor or performance improvement
• Test
• Build, CI, or maintenance

User and compatibility impact

Actual destructive commands hidden behind launcher options are blocked correctly. Benign heredoc/interpreter data remains unaffected. No API, configuration, persistence, or migration changes.

Architecture and complexity delta

• Canonical owner changed or extended: the existing astra-sandbox Bash AST command resolver now owns launcher option arity.
• Existing implementations and callers searched: transparent launcher resolution, nested shell resolution, destructive command classification, and astra-tools public Bash validation.
• Superseded code, states, tables, shims, or self-only tests removed: the permissive unknown-option-as-flag behavior is replaced; no new parallel parser or fallback was added.
• If parallel implementations remain, their boundary and retirement condition: shell syntax checks and the independent catastrophic rm -rf guard remain in astra-tools; destructive executable classification remains solely in astra-sandbox.

Verification

• Commands and results: cargo fmt --all -- --check; cargo test -p astra-sandbox --lib (153 passed); cargo test -p astra-tools --lib validate_execute_bash (11 passed); cargo clippy -p astra-sandbox -p astra-tools --all-targets -- -D warnings.
• Public entrypoint exercised: validate_execute_bash_command through the astra-tools validator tests.
• Unhappy paths exercised: exec -a, short-option clusters, dynamic option values, sudo -D, doas -a, pkexec --user, env -u, destructive and benign commands behind timeout/nice/ionice/setsid, nested wrappers, unknown option arity, env -S, and benign launcher arguments.
• Database verification: N/A; this is in-memory command validation and does not touch persistence.

Final checklist

• I added or updated tests at the layer that owns the behavior, or explained why no test is needed.
• I updated public or design documentation for contract changes, or the change needs no documentation update.
• I checked the diff for credentials, private URLs, customer data, generated files, and other sensitive information.
• The PR title follows the repository's Conventional Commit format.

[gouhongshen]

Synchronized the latest executable-dispatch review fix from #697 in 3fdec66: timeout/nice/ionice/setsid now resolve their child executable with explicit option/value grammar and fail closed on unknown option arity. The main and moi-dev variants have matching public validator coverage.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request