scriptrun: Generic runner + shared protocol surface

[ed-irl]

Adds the script-execution foundation and the cross-feature protocol
surface that the message generator and both auto-resolvers will use.

Runner (existing): executes a user-configured script either via
'sh -c' or by writing a shebang script to a temp file and exec'ing it.
stdout, stderr, and the exit code are returned without interpretation
so each feature can plug its own handler on top.

Shared protocol (new in this commit):

• ResolveResponse: the JSON document scripts emit on stdout (the
  union of {title, body, assumptions, questions, unresolved_files}
  fields). ParseResponse with ErrEmptyOutput / InvalidOutputError
  for diagnostics.
• QAPair: per-question persistent-resolution-file record.
• Operation enum and EnvFor(operation, branch, base) returning the
  shared GS_OPERATION / GS_BRANCH / GS_BASE env that every script
  receives. Feature-specific env layers on top.

Per-repo scratch directory (new in this commit):

• internal/spice/spicedir owns /.spice/.
• Path / EnsureDir for the directory; ResolutionPath /
  EnsureResolutionsDir for per-feature resolution files at
  .spice/resolutions/.json. Does not modify .gitignore --
  that's a project policy decision left to the user.

Configurable iteration cap (new in this commit):

• spice.scriptResolve.maxIterations (int, default 10) bounds the
  questions Q&A loop across all features.
• Config.ScriptResolveMaxIterations() reads it with default+warning
  fallback for invalid values.

Unit tests cover EnvFor, ParseResponse (empty/invalid/valid),
spicedir path + EnsureDir, and ScriptResolveMaxIterations parsing.

Together these are the surfaces that ed-irl/restack-auto-resolve,
ed-irl/integration-auto-resolve, and ed-irl/ai-message-gen will
consume in their respective fixups to collapse the existing
per-feature divergences. See doc/src/guide/scripts.md on
ed-irl/scripts-protocol-guide for the user-facing protocol contract.

[ed-irl]

This change is part of the following stack:

• restack: Add Options parameter to high-level restack entry points #1307
  • docs: Add shared protocol guide for script integrations #1249
    • scriptrun: Generic runner + shared protocol surface #1188 ◀
      • msggen: AI message generation via shared script protocol #1170
      • integration: Add state model for integration branch #1165
        • git: Add Merge, IsClean, and CheckoutNewBranch worktree helpers #1172
          • integration: Add handler package for integration branch operations #1173
            • integration: Wire gs integration command tree #1174
              • integration: Auto-rebuild integration branch after restack #1175
                • integration: Regenerate conflicted derived files on merge #1176
                  • integration: Add AI-driven conflict resolution #1251
                  • integration: Move regeneration out of merge driver #1252
                  • integration: accept-incoming fallback after auto-resolve #1253
                  • integration: submit tip downstacks alongside the integration branch #1254
                  • integration: surface integration branch and tips in gs ll #1255
                  • integration: short-circuit gs branch checkout for the integration #1256
                  • integration: gs ss from integration submits all tip stacks #1257
                  • integration: tip clean prunes subsumed tips #1258
                  • integration: tip advance moves tips to upstack leaves #1259
                  • integration: rebuild fixes and reliability improvements #1260
      • restack: AI-driven auto-resolve for rebase conflicts #1250

_{Change managed by git-spice.}

[abhinav]

extracted just the scriptrun functionality into #1276