tacacsrs_agent_ipc_emulator: support session shell authorization profile scenarios

[Rod-Persky]

Parent epic: #152

tacacsrs_agent_ipc_emulator: support session shell authorization profile scenarios

Objective

Extend the IPC emulator so session-wrapper tests can exercise startup session shell authorization with service=shell, empty cmd=, no cmd-arg, and returned landlock-* profile args.

Breaking changes are allowed. Prefer emulator behavior that cleanly supports the new production model over compatibility with older test scaffolding.

Required Scenario Behavior

• Match a session authorization request where:

service=shell
cmd=

• Verify no cmd-arg values are present for the startup profile request.
• Match context fields such as user, port, remote address, privilege level, and service where the emulator supports them.
• Return TACACS+ authorization statuses needed by startup tests: PASS_ADD, PASS_REPL, FAIL, ERROR, and FOLLOW.
• Return repeated landlock-* args, including direct args and landlock-profile-fragment=N/T:<payload> fragments.

Profile Fixtures

Provide fixtures for at least:

• Minimal enforce profile allowing a shell and /usr/bin/id.
• Profile that does not allow /tmp execution.
• Profile with explicit landlock-staging and landlock-staging-exec.
• Profile with landlock-privilege-elevation=sudo.
• Malformed profile for fail-closed tests.
• Fragmented profile payload.

Acceptance Criteria

• Emulator can drive a session-wrapper startup profile fetch before the child is spawned.
• Tests can assert empty cmd= and absence of cmd-arg.
• Tests can verify returned profile args are consumed by session-wrapper startup.
• Tests cover PASS_ADD, PASS_REPL, failure statuses, and fragmented profile args.