Feat/direnv exec guard

[ramarnat]

Summary

• add first-class rtk direnv support for literal direnv exec ...
• rewrite only direnv exec to rtk direnv ..., while leaving non-exec direnv subcommands as passthrough
• add built-in TOML guards that redact env dumps and auth-token reads on both stdout and stderr

Test plan

• cargo fmt --all && cargo clippy --all-targets && cargo test
• Manual testing: rtk <command> output inspected

Manual checks:

• target/debug/rtk direnv exec . env
• target/debug/rtk direnv exec . bash -lc 'printenv >&2'
• target/debug/rtk direnv exec . gh auth token
• target/debug/rtk direnv allow .
• target/debug/rtk direnv exec . pnpm --version

[CLAassistant]

All committers have signed the CLA.