session-wrapper: add secure CLI defaults and explicit emergency recovery mode

[Rod-Persky]

Parent epic: #152

session-wrapper: add secure CLI defaults and explicit emergency recovery mode

Objective

Update the session-wrapper CLI so the secure TACACS+ session profile + Landlock path is the default, while audit/disabled/emergency behavior is explicit and noisy.

Breaking changes are allowed. Remove or rename existing flags if they conflict with the production security model.

Required CLI Shape

Add or equivalent flags:

--landlock-mode enforce|audit|disabled
--landlock-profile-source tacacs-session
--profile-timeout-ms <MILLISECONDS>

Production defaults:

--landlock-mode enforce
--landlock-profile-source tacacs-session

Mode Semantics

• enforce: fetch, parse, validate, and apply the TACACS+ profile. Fail closed if anything fails.
• audit: fetch, parse, validate, do not apply Landlock, log would-block exec findings, and warn that no kernel boundary is installed.
• disabled: do not fetch or apply a profile. Explicit unsafe mode for tests and recovery only.

The existing per-command --fail-policy must not apply to startup profile authorization. Startup profile enforcement is fail-closed in enforce mode.

Emergency Recovery

• Provide an explicit setup/recovery mode for device bring-up or TACACS+ outage recovery.
• Do not hard-code a username such as admin in source.
• Emergency behavior should be selected by login integration or provisioning, for example by configuring a local admin shell invocation with explicit recovery flags.
• The recovery path must be auditable and must not look like an ordinary TACACS+-authorized session.

Allowlist Cleanup

• Remove production --allowlist behavior or make it unavailable in production profile mode.
• Any production bypass or cache of per-exec TACACS+ authorization must come from explicit TACACS+ profile args, not from local files.

Acceptance Criteria

• CLI defaults select enforce + TACACS session profile source.
• Audit and disabled modes print/log clear unsafe-mode warnings.
• Enforce mode ignores per-command fail-open behavior for startup profile failures.
• Emergency/recovery mode is explicit, auditable, and not tied to a hard-coded username.
• CLI help/man page output reflects the new security model.