style: apply ruff lint --fix + ruff format across the tree

style(exec): move nosec B310 rationale to a comment (ADR-0014 bandit hygiene)

feat(exec): sandboxed per-session exec-kernel executor (ADR-0007 Phase 1)