Constrained Jira CLI invocation wrapper with host-level argument enforcement

## Context

The Jira Backlog Executor (`.github/agents/project-planning/subagents/jira-backlog-executor.agent.md`) holds a general terminal grant. Its prose limits that terminal to the `jira` skill CLI, and PR #2602 hardened those stop rules into an auditable invocation shape with explicit rejection classes. That is a prose contract, not an enforced boundary: nothing at the host level prevents the agent from running an unrelated command.

The CLI's own parser allowlists exactly eight subcommands (`search`, `get`, `create`, `update`, `transition`, `comment`, `comments`, `fields`), so anything reaching Jira *through the CLI* is bounded. The gap is that the host does not force the agent through the CLI at all.

## Why this was deferred

A reviewer on PR #2602 proposed a dedicated Jira tool wrapper using structured arguments and direct process invocation. That infrastructure does not exist in this repository. Building it is new capability rather than a correction, so it was scoped out of the review remediation.

The reviewer's fallback suggestion — stop presenting the executor as write-capable — was rejected on provenance evidence: the predecessor agent on `main` held the same shell with no stated boundary anywhere in the file. Removing write capability would ship less Jira capability than `main` provides today.

## Proposed work

A constrained invocation wrapper that enforces at the host level what the prose currently asks for:

- Structured arguments rather than a composed command string
- Subcommand allowlist matching the CLI's own eight
- No shell interpretation: no pipes, redirection, command substitution, chaining, or alternate interpreters
- Destination checks bound to the confirmed project key
- Bounded output
- Credential redaction

## Acceptance criteria

- [ ] A Jira operation cannot be issued except through the wrapper
- [ ] A command outside the eight allowed subcommands is rejected by the wrapper, not by prose
- [ ] Shell metacharacters in any argument are passed as literal data or rejected, never interpreted
- [ ] Credential values cannot appear in wrapper output
- [ ] The executor's residual-risk statement is updated to reflect enforcement once the wrapper lands

## Evidence

- PR #2602 review threads covering Jira executor tool authority
- `.github/agents/project-planning/subagents/jira-backlog-executor.agent.md` — Terminal invocation shape section and its stated residual risk
- `.github/skills/project-planning/jira/scripts/jira.py` — the eight-subcommand parser allowlist