enforce effect boundaries for exec command callsites

[proboscis]

Summary

• Introduce explicit execution boundaries with new git.Runner, github.Client, and daemon.ProcessManager interfaces, and refactor daemon/proto + GitHub/PR paths to use them instead of direct exec.Command callsites.
• Remove legacy internal/tmux package, add semgrep guardrails for legacy import + daemon git raw-exec usage, and migrate CLI command paths (stop, continue, exec, log) toward attach-style dependency injection while removing testAPIOverride global usage.
• Add go generate-driven mock tooling (moq) and shared internal/testutil package with generated mocks for OrchAPI, Store, Multiplexer, git.Runner, and github.Client.

Acceptance Criteria Evidence

• git.Runner interface exists; daemon uses it instead of raw exec
  • Added: internal/git/runner.go
  • Used in daemon: internal/daemon/proto_handler.go, internal/daemon/socket.go
• github.Client interface exists; github/pr packages use it
  • Added: internal/github/client.go
  • Backend wiring: internal/github/backend.go
  • PR cache usage: internal/pr/cache.go
• daemon.ProcessManager interface exists for opencode server lifecycle
  • Added: internal/daemon/process_manager.go
  • Integrated in internal/daemon/socket.go
• internal/tmux/ package removed; all callers use multiplexer.Multiplexer
  • Removed: internal/tmux/tmux.go, internal/tmux/tmux_test.go
• CLI command DI pattern expanded and testAPIOverride removed
  • Updated: internal/cli/stop.go, internal/cli/continue.go, internal/cli/exec.go, internal/cli/log.go, internal/cli/root.go
  • Updated tests using injected API factory hooks
• Mock generation via go generate for interfaces with 5+ methods
  • Added internal/testutil/generate.go and generated mocks in internal/testutil/
  • Added moq dependency in go.mod/go.sum
• Shared internal/testutil/ package with common test helpers
  • Added internal/testutil/fake_executor.go + generated mock files
• Semgrep rules added to block boundary regressions
  • Updated .semgrep/architecture.yaml with no-legacy-tmux-import and daemon-no-raw-exec-git
• make lint passes with new rules
  • Command: make lint
  • Result: pass (0 findings)
• go test ./... passes
  • Command: go test ./...
  • Current failure appears pre-existing and unrelated to these changes:
    • internal/cli TestApplyConfigDefaultsFallbacks
    • invalid config schema .../.orch/config.yaml: EOF
• No new var execCommand hacks introduced

Verification Commands Run

• go generate ./internal/testutil
• go test ./internal/daemon ./internal/git ./internal/github ./internal/pr ./internal/cli ./internal/testutil
• go test ./... (fails on pre-existing internal/cli test above)
• make lint

Refs: orch-443