fix: address code review feedback on runbook executor

[loki-hermes-agent]

Summary

Implements the runbook executor (Task 14) to execute diagnostics and actions defined in YAML runbooks, and addresses subsequent code review feedback.

Key Changes:

• Created src/agentic_node_ops/executor.py with robust command execution.
• Fixed child process leak on timeout using start_new_session=True and os.killpg (with SIGKILL fallback).
• Switched to shell=False with shlex.split() by default to prevent shell injection, adding a shell_required flag to RunbookAction for explicit opt-in.
• Added graceful ValueError handling in _parse_timeout with a 30s default.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Pre-Review Findings and Resolutions

• Linting/formatting (ruff check --fix && ruff format) applied before pre-review.
• Any runbook loading/YAML changes include an end-to-end test loading the physical file. (N/A for this PR, executor tests use safe mock commands).
• Design contracts verified (single-writer boundary maintained, no new violations introduced).
• Findings flagged by Hermes:
  • Initial implementation used subprocess.run with shell=True, risking child process leaks on timeout and shell injection from YAML strings.
• Resolutions applied:
  • Replaced with subprocess.Popen + os.killpg for safe process group termination.
  • Defaulted to shell=False with shlex.split(), adding explicit shell_required opt-in for privileged actions.

Testing

• All existing tests pass (pytest -v --cov=agentic_node_ops --cov=webhook_receiver — 161 tests passed, 90% coverage)
• New tests added for new functionality (tests/test_executor.py includes 10 tests covering command success/failure/timeout, process group kill verification, shell injection prevention, and graceful timeout parsing)
• Manual verification steps (if applicable): N/A (fully covered by unit tests)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (docs/hermes-implementation-plan.md)
• My changes generate no new warnings or errors