Model service command: single-string `command`, shell semantics execution

Consolidate the model service start command around a single shell command string and clean up the execution path.

This epic groups the internal string-representation work (BA-6550), the v2 API surface change adding `command: String` and deprecating `start_command: [String!]` (BA-6551), and the kernel execution mechanism that runs the shell command via a GitHub Actions-style temp script.

Key decisions (from requirements review):
- Default shell stays `/bin/bash` (NOT flipped to None); an explicit `shell: null` disables the shell and execs argv directly.
- The shell path writes the resolved command to a uniquely-named temp script (mkstemp) and runs `bash --noprofile --norc -eo pipefail ` — GitHub Actions parity, debuggable, collision-safe vs image-shipped /tmp/start.sh.
- SIGTERM propagation and set -e/pipefail behavior for multiline scripts are verified empirically as part of the kernel-exec story.

JIRA Issue: BA-6613

No files, tests, or entry points are named. Start by locating the model service start-command API and kernel execution path, then verify the documented shell, temporary-script, signal, and multiline error-handling requirements empirically; done means the grouped BA-6550, BA-6551, and kernel-exec changes are covered.

Written by the indexing model from the issue text.