refactor!: remove versioned system-run approval contract

src/infra/exec-command-resolution.ts

@@ -9,6 +9,7 @@ export const DEFAULT_SAFE_BINS = ["jq", "cut", "uniq", "head", "tail", "tr", "wc
 export type CommandResolution = {
   rawExecutable: string;
   resolvedPath?: string;
+  resolvedRealPath?: string;
   executableName: string;
   effectiveArgv?: string[];
   wrapperChain?: string[];
@@ -86,6 +87,17 @@ function resolveExecutablePath(rawExecutable: string, cwd?: string, env?: NodeJS
   return undefined;
 }
 
+function tryResolveRealpath(filePath: string | undefined): string | undefined {
+  if (!filePath) {
+    return undefined;
+  }
+  try {
+    return fs.realpathSync(filePath);
+  } catch {
+    return undefined;
+  }
+}
+
 export function resolveCommandResolution(
   command: string,
   cwd?: string,
@@ -96,10 +108,12 @@ export function resolveCommandResolution(
     return null;
   }
   const resolvedPath = resolveExecutablePath(rawExecutable, cwd, env);
+  const resolvedRealPath = tryResolveRealpath(resolvedPath);
   const executableName = resolvedPath ? path.basename(resolvedPath) : rawExecutable;
   return {
     rawExecutable,
     resolvedPath,
+    resolvedRealPath,
     executableName,
     effectiveArgv: [rawExecutable],
     wrapperChain: [],
@@ -119,10 +133,12 @@ export function resolveCommandResolutionFromArgv(
     return null;
   }
   const resolvedPath = resolveExecutablePath(rawExecutable, cwd, env);
+  const resolvedRealPath = tryResolveRealpath(resolvedPath);
   const executableName = resolvedPath ? path.basename(resolvedPath) : rawExecutable;
   return {
     rawExecutable,
     resolvedPath,
+    resolvedRealPath,
     executableName,
     effectiveArgv,
     wrapperChain: plan.wrappers,