Enforce exec boundaries with interfaces and generated mocks

[proboscis]

Summary

• Enforced git/gh/process exec boundaries by introducing git.Runner, github.Client, and daemon ProcessManager, then routing daemon/github/pr callsites through those interfaces.
• Removed legacy internal/tmux package, added go generate mock pipeline in internal/testutil/mocks, and generated mocks for OrchAPI, Store, Multiplexer, git.Runner, and github.Client.
• Applied attach-style DI structs to CLI commands (stop, continue, exec, log) and added semgrep architecture guards for raw exec and legacy tmux imports.

Acceptance Criteria Evidence

• git.Runner interface exists; daemon uses it instead of raw exec
  • Added: internal/git/runner.go
  • Daemon switched to runner usage in internal/daemon/proto_handler.go and internal/daemon/socket.go.
• github.Client interface exists; github/pr packages use it
  • Added: internal/github/client.go
  • internal/github/backend.go and internal/pr/cache.go now call the client abstraction.
• daemon.ProcessManager interface exists for opencode server lifecycle
  • Added: internal/daemon/process_manager.go
  • internal/daemon/socket.go now routes lifecycle operations through processMgr.
• internal/tmux/ package removed; all callers use multiplexer.Multiplexer
  • Deleted: internal/tmux/tmux.go, internal/tmux/tmux_test.go.
• CLI commands use attachDeps-style DI (no more direct hardwired deps in targeted commands)
  • Updated: internal/cli/stop.go, internal/cli/continue.go, internal/cli/exec.go, internal/cli/log.go.
• Mock generation via go generate for interfaces with 5+ methods
  • Added directives: internal/testutil/mocks/generate.go
  • Generated files: orchapi_moq.go, store_moq.go, multiplexer_moq.go, git_runner_moq.go, github_client_moq.go.
• Shared internal/testutil/ package with common test helpers
  • Added: internal/testutil/mocks/ with generated reusable mocks.
• Semgrep rules block raw exec.Command in daemon/cli/monitor layers
  • Added rules in .semgrep/architecture.yaml: no-raw-exec-outside-boundary, no-legacy-tmux-import.
• make lint passes with new rules
  • Command: make lint (pass).
• go test ./... passes
  • Command: go test ./... (pass).
• No new var execCommand hacks introduced
  • New abstraction work does not introduce additional var execCommand shims.

Validation Commands

• go test ./...
• make lint
• go generate ./internal/testutil/mocks

Refs: orch-443