refactor(exec): centralize subprocess execution

[jmgilman]

Summary

• add internal/execx as the single production subprocess mechanism
• migrate apko, cosign, ghup, gitx, melange, and GoReleaser execution
• centralize path resolution, stream routing, bounded stderr capture, WaitDelay, and typed exit metadata
• keep argv, ordering, credentials, parsing, retries, and domain errors in each consumer
• remove the six duplicated execution helpers and consolidate their mechanism tests

Verification

• mise exec -- go test ./internal/execx -count=1
• targeted tests for all six consumer packages
• mise exec -- moon run root:check
• docker run --rm --cpus 4 -v "$PWD:/src" -w /src -e GOFLAGS=-mod=mod golang:1.26 go test ./... -count=1
• structural check: production os/exec remains only in internal/execx; the one other use is test-only Git fixture setup