[dcode] Add a bounded managed headless validation-command profile

## Problem

Managed headless Deep Agents Code is intentionally fail-closed around shell execution:

- the public documentation says `dcode -n` automatically approves non-shell tools but disables
managed shell execution, startup commands, interpreter tool calling, executable hooks, and
unmanaged extensions;
- thread-wide auto-approval is an interactive capability and does not apply to the separate
headless automation boundary.

That is a safe default, but it leaves no supported public contract for an unattended coding worker
that must run a small, operator-reviewed validation profile (for example an exact test, typecheck,
or formatter command) against an immutable source revision. Allowing the model to invoke arbitrary
shell, using `dcode -y`, or bypassing NemoClaw/OpenShell policy would be unsafe and does not solve
the contract gap.

## Requested public contract

Add a managed headless command-execution mode that remains default-off and can be enabled only with
an immutable, bounded validation-command profile supplied through a supported NemoClaw lifecycle
surface.

The profile should:

1. identify an exact versioned schema and content digest;
2. allow only reviewed executable/argument shapes, working-directory roots, environment names,
timeouts, output limits, and invocation counts;
3. reject shell metacharacter interpretation, compound commands, redirects, substitutions,
interpreters outside the profile, startup hooks, executable repository hooks, and ambient PATH
drift;
4. bind execution to the intended sandbox and immutable task/source identity;
5. remain subject to OpenShell filesystem, network, credential, and resource policy;
6. expose the effective profile and digest through public machine-readable status/policy output;
7. produce bounded execution receipts containing command identity, working directory, terminal
status/exit classification, duration, and stdout/stderr digests without leaking credentials; and
8. leave arbitrary shell and interactive thread auto-approval disabled.

The model may request one profile entry, but the managed runtime—not prompt text—must decide whether
the exact invocation is admissible.

## Acceptance criteria

- Without a profile, managed `dcode -n` continues to deny every shell request.
- A public NemoClaw onboarding/rebuild or sandbox-lifecycle input installs an exact profile and
returns a machine-readable receipt bound to its digest.
- Headless DCode can run an allowed exact-argv validation command and returns a bounded receipt.
- Near matches, extra arguments, metacharacters, alternate executables, symlink/path escapes,
environment injection, excessive output, timeout, and invocation-budget exhaustion fail closed.
- Tests exercise an untrusted repository and prompt attempting to escape the profile.
- Public `sandbox policy explain --json` or an equivalent supported command proves the effective
command profile before execution.

## Use case

Host-agnostic coordinator/worker scenarios need reset-per-job DCode workers to inspect and validate
one immutable PR head while holding no GitHub or Slack authority. Fran the Release Preparer must
report which feedback-driven repair it would make and which allowlisted tests it actually ran; a
proposal-only result does not satisfy that exact-SHA validation requirement.

Start with the public NemoClaw onboarding/rebuild or sandbox-lifecycle input and the supported `sandbox policy explain --json` command. Trace how a profile and digest could be installed, exposed, and bound to headless DCode execution. Done means the acceptance criteria pass, including fail-closed near matches and bounded execution receipts.

Written by the indexing model from the issue text.