Complete typed OpenShell adapters for deferred logs, diagnostics, and version consumers

Parent Epic: #9802
Originating capability: #9812
Partial implementation: #11835

## Scope decision

**Decision: Accept.** Rebecca Sliter accepted this deferred Phase 1 scope on 2026-09-15 as part of the #9812 implementation plan.

- Reason: Finish the remaining production consumers after the independently valuable public sandbox-log slice.
- Placement: Capability-specific typed OpenShell adapters, with current action and diagnostic owners retaining product decisions.
- Accountable maintainer and implementation owner: @rsliter
- Validation: Action tests against typed fakes, CLI-adapter contract tests, and focused process tests only where executable behavior cannot be proven at a stable local boundary.

## Outcome

Complete Phase 1 typed-adapter coverage for the production consumers intentionally deferred by the first #9812 PR:

- `src/lib/actions/sandbox/exec-policy-hint-emission.ts`: bounded policy-denial log probing.
- `src/lib/diagnostics/debug.ts` and `src/lib/diagnostics/debug-command-deps.ts`: OpenShell debug collection and observation wiring.
- `src/lib/onboard/docker-gpu-patch-diagnostics.ts`: failure-only OpenShell diagnostic collection.
- `src/lib/onboard/openshell-version.ts`: installed OpenShell version probing.

The implementation must preserve each consumer's current output, redaction, timeout, degradation, and exit behavior. Phase 1 closure issue #9813 records the final disposition of each executable-level diagnostic.

## Acceptance evidence

- Each action or collector uses a typed fake and no longer constructs OpenShell argv or classifies process-shaped results.
- CLI adapter tests own exact argv, explicit gateway targeting, environment allowlisting, bounded capture, timeout behavior, error mapping, and redaction.
- Existing debug archive, GPU diagnostic redaction, policy hint, and version compatibility tests remain green.
- Any executable-level diagnostic retained as an intentional exception is explicitly accepted and recorded in #9813.

## Exclusions

- No SDK or direct gRPC implementation. Phase 2 remains #9829.
- No new debug archive contents, log flags, settings keys, output formats, retry policy, or version compatibility range.
- No installer, build, repository script, E2E harness, plugin, gateway lifecycle, or third-party product surface changes.

## Dependencies and stop conditions

- Depends on partial implementation #11835 for the public sandbox-log adapter.
- Coordinate runtime-identity and executable-disposition decisions with #9813.
- Stop for any new product behavior, credential flow, retry policy, compatibility rule, security boundary, additional production consumer, or overlap that changes ownership.