fix(core): gate Unix-only exec-policy test items

[andrei-hasna]

Summary

• cfg-gate the Unix-only GranularApprovalConfig and ReviewDecision test imports
• cfg-gate COMPLEX_FORCED_RM_COMMAND with its two non-Windows consumers
• preserve the existing Unix exec-policy tests without warning suppression or behavior changes

Verification

• just check-fast -p codex-core
• just fix -p codex-core
• just fmt
• staged and branch-range secret scans
• exact-head Blacksmith Testbox dispatched

Native Windows MSVC x64 and ARM jobs are required before merge.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}