Executor middleware chain: Permission + Audit

[EdmondDantes]

What

Moves tool execution behind one transparent entry point with a middleware onion — the ARCHITECTURE.md "Executor + middleware chain" design. First slice of the executor arc.

New (src/Exec/)

• ExecutorInterface / MiddlewareInterface — the contract: call(ToolCall): ToolResultBlock, and middlewares that wrap $next (inspect / short-circuit / log).
• ChainExecutor — composes the onion around a terminal handler (outer → inner).
• PermissionMiddleware — the security layer, lifted out of Session::execute(): resolves the tool's Risk, asks Policy, then blocks / asks the user (Confirm) / passes through; an "always" approval persists a rule.
• AuditMiddleware — logs every call (including blocked/denied) to a new SQLite audit table; sits outermost so it captures the verdict.

Changed

• Session builds the chain from its existing deps (policy, tools, conversation, store) and delegates; the terminal stage (runTool) resolves + runs the tool. Behaviour is unchanged — the existing SessionTest now exercises the chain and still passes.
• SessionStore: audit table + logToolCall() / auditTrail().

Why now

The agent is remotely reachable (Telegram) and runs bash, so an action trail matters; and pulling the gatekeeper into the chain is the home the next middlewares plug into.

Deferred (next slice)

TimeoutMiddleware (\Async\timeout() around a tool) + /stop turn cancellation.

Tests

tests/Exec/* — chain ordering + short-circuit; permission allow/deny/confirm; audit logs + no-op without a store.

88 tests pass, PHPStan level 8 clean, php-cs-fixer clean.

[EdmondDantes]

Added TimeoutMiddleware to the chain (innermost): runs each tool in a child coroutine and awaits it with Async\timeout(); on the deadline it cancels the coroutine — TrueAsync propagates the cancellation into a running bash subprocess and kills it — and returns an error result. Session gains an optional toolTimeoutMs (0 = off; existing tests unaffected), wired from CLAW_TURN_TIMEOUT_MS. Now 90 tests, PHPStan level 8, php-cs-fixer all green.