feat(mediation): DSL redesign — explicit defaults, grants, three-action set

[kipz]

Summary

Full redesign of nono's command mediation DSL and security model, implementing ETI gap-closure plans 1–4.

DSL changes

Explicit default block. Every mediation.commands entry now has a default with an action (allow/deny) and optional sandbox. There is no implicit passthrough — unmatched invocations are governed by the default, which must be declared.

Three action types (renamed from run/respond):

• allow — execute the binary. Carries optional script.
• deny — return canned stdout/stderr/exit_code without running anything.
• capture — intercept credential-fetching commands, return a nonce, promote to a real token only when an authorised command requests it.

deny_unknown_fields on all eight mediation structs. Invalid profile fields are rejected at load time rather than silently ignored.

Authorization graph — can_use / session_can_use

Replaces caller_policy. session_can_use at the mediation root lists commands the agent entry-point may invoke directly; can_use on each command entry lists commands it may invoke as children. The graph is validated at profile load: every name must resolve to a known command.

from{caller} passthrough

Replaces allow_commands. Per-caller behaviour map on CommandEntry, keyed by calling command name. { "action": "passthrough" } bypasses intercept rules for that caller, enabling credential chains (e.g. ddtool → curl) without exposing raw tokens to the primary sandbox. Requires mutual consent at validation time.

Binary identity pinning

Captures each mediated binary's dev/inode/size/mtime/sha256 at session start (O_NOFOLLOW). Re-verifies before every spawn. Fail-closed: a missing or mismatched pin blocks the exec.

Symlink fix: Homebrew installs binaries as symlinks under /opt/homebrew/bin. O_NOFOLLOW returns ELOOP on symlinks. Both pin_binary and verify_pin now canonicalize the path before opening.

Dynamic token expansion

expand_profile_tokens_with previously only walked the legacy cmd.sandbox field, so @git:config-files tokens in cmd.default.sandbox (the new DSL path) were never expanded. Fixed by walking cmd.default.sandbox and per-intercept sandboxes. New unit test covers this.

Regex: unicode-perl feature

The regex crate was configured without unicode-perl, so \s, \d, \w in intercept match patterns failed at runtime when a profile was loaded. Added the feature and a regression test.