refactor: dedupe exec wrapper denial plan and test setup

src/infra/exec-wrapper-resolution.ts

@@ -448,6 +448,19 @@ function isSemanticDispatchWrapperUsage(wrapper: string, argv: string[]): boolea
   return !TRANSPARENT_DISPATCH_WRAPPERS.has(wrapper);
 }
 
+function blockedDispatchWrapperPlan(params: {
+  argv: string[];
+  wrappers: string[];
+  blockedWrapper: string;
+}): DispatchWrapperExecutionPlan {
+  return {
+    argv: params.argv,
+    wrappers: params.wrappers,
+    policyBlocked: true,
+    blockedWrapper: params.blockedWrapper,
+  };
+}
+
 export function resolveDispatchWrapperExecutionPlan(
   argv: string[],
   maxDepth = MAX_DISPATCH_WRAPPER_DEPTH,
@@ -457,36 +470,33 @@ export function resolveDispatchWrapperExecutionPlan(
   for (let depth = 0; depth < maxDepth; depth += 1) {
     const unwrap = unwrapKnownDispatchWrapperInvocation(current);
     if (unwrap.kind === "blocked") {
-      return {
+      return blockedDispatchWrapperPlan({
         argv: current,
         wrappers,
-        policyBlocked: true,
         blockedWrapper: unwrap.wrapper,
-      };
+      });
     }
     if (unwrap.kind !== "unwrapped" || unwrap.argv.length === 0) {
       break;
     }
     wrappers.push(unwrap.wrapper);
     if (isSemanticDispatchWrapperUsage(unwrap.wrapper, current)) {
-      return {
+      return blockedDispatchWrapperPlan({
         argv: current,
         wrappers,
-        policyBlocked: true,
         blockedWrapper: unwrap.wrapper,
-      };
+      });
     }
     current = unwrap.argv;
   }
   if (wrappers.length >= maxDepth) {
     const overflow = unwrapKnownDispatchWrapperInvocation(current);
     if (overflow.kind === "blocked" || overflow.kind === "unwrapped") {
-      return {
+      return blockedDispatchWrapperPlan({
         argv: current,
         wrappers,
-        policyBlocked: true,
         blockedWrapper: overflow.wrapper,
-      };
+      });
     }
   }
   return { argv: current, wrappers, policyBlocked: false };