test: add governance CLI fixture coverage

[CoderDeltaLAN]

Adds CLI fixture coverage for AIRK-GOV004 and AIRK-GOV005.

Summary:

• adds a dedicated unsafe command execution fixture
• adds a dedicated runtime network / LLM fixture
• verifies AIRK-GOV004 in console, JSON, and Markdown output
• verifies AIRK-GOV005 in console, JSON, and Markdown output
• asserts rule_id, severity, path, and line number through the CLI path

Boundary:

• does not change governance regexes
• does not change CLI behavior
• does not touch README, CHANGELOG, release, tag, version, CI, branch protection, dependencies, docs, or architecture

Verification:

• targeted CLI tests for GOV004/GOV005
• ./scripts/check.sh
• smoke CLI checks for console, JSON, and Markdown
• isolated build and wheel smoke before push