feat(executor): add scoped directory helper

[SaladDay]

The pinned native filesystem walk re-resolves pathnames during enumeration and collects directory names before applying its entry cap. It cannot establish the directory isolation required by the pending Files consumer.

Add a separately named, one-shot directory helper beside the existing executor launcher. It traverses directories without following symlinks, enumerates and stats through retained descriptors, applies the entry bound during scanning, and returns explicit truncation or a settled error. The native process API supplies transport and sandboxing. Installation and workspace authority remain the caller's responsibility.

This PR delivers only the helper prerequisite and its acceptance fixture. It does not enable the Codex adapter or public Files, modify Core/schema, patch stock native filesystem behavior, or change the model/tool loop. PR #675 remains draft and blocked pending safe adapter integration.

Validation:

• Locked tests, rustfmt and Clippy passed: 5 descriptor tests and 8 existing launcher tests.
• Independent release build passed.
• Built helper and rebuilt launcher passed actual PostgreSQL/registry/Noise/Docker native-process acceptance: 6 directory requests, Linux sandbox reported, 5,000-entry bounded case, native exit/output closure. Synthetic files and zero model calls; this is mechanism acceptance only.
• Full server make check passed in 517.87 seconds at 8907c9dc; fresh independent whole-diff review found no actionable issues in all 11 changed files.
• OpenAPI/sqlc generation does not apply: no handler or query changes.

Evidence: ~/.parsar/remediation/20260917/native-directory-isolation/ on zju_a100_2. Later adapter/public integration still requires real-provider execution, fixed SDK and raw HTTP acceptance. No complete compatibility claim.