refactor(cli): centralize provisioning execution policy

[ElbertePlinio]

Summary

• centralize plan classification, consent, dry-run, ordered cancellation/failures, and partial results in one provisioning executor
• move sudo routing out of planners and behind the local execution adapter, leaving a clean approval seam for Support secure graphical sudo prompts for agent commands #27
• migrate setup lab-user, setup android, doctor, and init while preserving prompts and CLI/JSON output
• redact public plans, logs, errors, and partial results without changing executed argv

Validation

• bun run test packages/cli/test/executor.test.ts packages/cli/test/planner.test.ts packages/cli/test/cli.test.ts (68 passed)
• bun run typecheck
• bun run build
• git diff --check origin/main...HEAD
• verified MCP sources have no provisioning executor or sudo route

Refs #44 (CAND-4)