Require confirmation for eval deep links

[r-sandeep]

Summary

• parse deep-link commands before dispatch and identify commands that resolve to eval
• require an explicit affirmative confirmation displaying the exact parsed command before dispatching an eval deep link
• prevent denied or unconfirmed eval links from dispatching, including resize replays
• add one focused regression test covering denial, an unconfirmed result, approval, exact confirmation text, and replay behavior

Scope

The repair changes only:

• js/terminal-ext.js
• tests/terminal-ext.test.js

It does not change the deep-link parser structure, bootstrap preload path, command configuration, generated output, or introduce allowlist infrastructure.

Validation

• npm test — passed (7 test files, 121 tests)
• npm run build — passed
• clean-checkout npm test — passed
• clean-checkout npm run build — passed
• adversarial review — completed with no actionable defect found

Approvals and policy

All recorded policy decisions are allow, and the work packet has no open approvals or unresolved risks blocking delivery.

ASD workflow

• Task: task_0fdea2d9b09e47729861c25469f42a96
• Workflow: workflow_run_1d31313194df4511a302a00e73b236e9
• Lane: enterprise_bug_fix_council_v1
• Work packet node: prepare_outcome_delivery