Add preserved path shell preflight

[evawong-oai]

Summary

Add a shell preflight layer that gives users an early explanation when a literal redirection targets a preserved agent metadata path.

Scope

1. Add a shared shell command helper for literal preserved path write targets.
2. Use that helper in debug sandbox handling.
3. Use that helper in agent shell handling.
4. Leave direct command creation attempts to sandbox enforcement.

Reviewer Focus

1. This is user experience only.
2. Security remains in the policy and platform sandbox layers.
3. Direct commands such as mkdir .codex are intentionally not treated as preflight security logic here.

Stack

1. Policy primitive: Add preserved path policy primitive #19846
2. macOS Seatbelt enforcement: Enforce preserved path names in Seatbelt #19847
3. Shell preflight: this PR
4. Runtime permission propagation: Propagate runtime permission profiles #19849
5. Linux bubblewrap enforcement: Enforce preserved path names in Linux sandbox #19852

Validation

1. Shell command tests passed locally.
2. CLI and core compile check passed locally.
3. Formatter passed locally.
4. Bazel lock drift check passed locally.