Harden LDS core and CLI execution surfaces

[abmmhasan]

Summary

Hardens the LDS execution surfaces around one shared container/domain execution substrate.

Shared execution layer

Adds lib/execution.sh to centralize:

• current-project Compose service resolution;
• exact running-container fallback;
• stopped/missing/ambiguous target diagnostics;
• adaptive Docker exec flags;
• argv-preserving explicit command execution;
• interactive Bash -> sh fallback;
• optional working-directory execution;
• domain discovery and domain -> app/container/docroot resolution;
• Git Bash/MSYS Docker path-conversion protection.

lds cli

lds cli is now the dependable low-level service/container executor:

lds cli <service|container>
lds cli <service|container> -- <command> [args...]
lds cli <service|container> <command> [args...]

Changes:

• current-project Compose services resolve first;
• exact container names/IDs remain supported;
• no implicit case conversion;
• explicit argv is not flattened through $*;
• piped/non-TTY commands do not force -t;
• no-command mode opens an interactive shell.

lds core

lds core remains domain/application aware but delegates Docker mechanics:

lds core
lds core <domain|service|container>
lds core <domain|service|container> -- <command> [args...]

• stable domain discovery/picker;
• one-domain auto-selection;
• actionable non-TTY multi-domain behavior;
• domain metadata centralized through Tools domain-which;
• Node domains use /app;
• other domains use resolved docroot -> /app -> / fallback;
• service/container fallback uses the same common resolver;
• explicit command mode preserves argv.

Adjacent execution surfaces

• lds stack exec / lds exec use the same resolver/TTY/argv helpers while remaining service-only;
• lds tools sh uses the common shell helper;
• lds tools exec is argv-preserving;
• explicit shell-expression compatibility is available as lds tools shell-exec '<expression>';
• lds ui uses the common interactive argv path.

CLI routing and UX

• replaces open-ended dynamic cmd_$cmd publication with an explicit public built-in command router;
• keeps unknown-command fallback delegated to bin/tool-runner;
• updates embedded help and docs/reference/cli.rst to clearly distinguish core, cli, stack exec, and tools.

Regression coverage

Adds a dedicated execution-surface contract covering:

• service-first and exact-container resolution;
• case preservation;
• missing/stopped/ambiguous targets;
• adaptive TTY flags;
• argv containing spaces/metacharacters;
• paths containing spaces;
• Git Bash/MSYS path conversion;
• child exit-status propagation;
• non-TTY shell rejection;
• Bash -> sh fallback;
• working-directory fallback;
• centralized domain discovery/resolution.

CI also retains Linux, Windows bridge, Compose, networking, permission, wrapper, runtime, docs, Graphify, LLM, and published-image contracts.

Cleanup

The completed Core/CLI plan has been removed. No LocalDevStack plan files remain under docs/plans.

Validation

Final check run: #1045 — green

The branch is based on current main, is 18 commits ahead / 0 behind, has no review-thread blockers, and is mergeable.