ops-exec: trusted executor (E1+E2), Sando refactor, thin macOS driver
sando: typed gate outcomes and observability scaffolding