[Feat] Add the Destructive Command Guard binary service

[navedmerchant]

Related GitHub Issue

Closes #1056
Part of #1049. Split from #1050.

Description

Adds a self-contained service boundary for the pinned Destructive Command Guard binary. It selects platform-specific archives, installs and verifies the binary through the managed-binary infrastructure, deduplicates concurrent installation requests, and runs DCG with typed allow/deny results.

This PR does not add a setting or change command auto-approval behavior.

Stack

2 / 4 — base: feat/managed-binary-infrastructure

Review only the six files in this PR's own diff. Merge after the managed-binary PR; GitHub will retarget the surviving stack automatically or the base can be changed to main after its dependency merges.

Test Procedure

pnpm --dir src exec vitest run services/destructive-command-guard/__tests__/manager.spec.ts services/destructive-command-guard/__tests__/runner.spec.ts
pnpm --dir src check-types

Result: 2 test files passed, 22 tests passed; type-check passed. Repository pre-push type-check also passed.

Checklist

• Focused issue and independently meaningful service
• Tests included and passing
• Type-check/lint passing
• No changeset added
• No user-facing behavior enabled yet

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: baede994-964b-4b98-9641-5bc3ee84643a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 95.34884% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/services/destructive-command-guard/runner.ts	92.15%	0 Missing and 4 partials ⚠️

📢 Thoughts on this report? Let us know!

[edelauna]

Looks good - just had 2 comments for increased test coverage.

[edelauna]

😅 have a couple additional comments related to the logic used for the guard.