report: categorize parser refusals + show blocked command + add 'failsafe log' (closes #3, #4)

[Tombar]

Closes #3. Closes #4.

#3 — refusals are no longer blank rows

Shell-parser refusals now carry a machine-readable kind, logged as Tool=shell, Verb=unanalyzable, Subverb=<kind> (glob, heredoc, control-flow, dynamic-head, subshell, plus background/input-redirect/fd-redirect/env-prefix/assignment/binary-op/wrapper/parse/other). Extract now returns a *Refusal{Kind, Message}. failsafe report gains a Subverb column, so refusals break down per kind instead of rendering blank Tool/Verb.

#4 — see which command, and inspect the log

• failsafe report scariest section now shows the command (already redacted at write time) and the tool/verb/subverb category, not just the reason.
• New failsafe log [--tail N] [--since DUR] [--json] to inspect recent decisions (time, decision, category, cwd, reason, redacted command) without grepping the JSONL. Reuses report's readRecords/parseSince (no duplication). Empty/missing log → friendly message.

Test Plan

• go test ./... — 12/12 packages (new shellparser kind tests, report Subverb + command tests, 9 log tests)
• live failsafe log --tail runs and renders categorized decisions
• --json emits valid JSON lines; missing log → friendly exit 0

Note: the log path is resolved via auditlog.DefaultLogger (main-era). When the config PR (#7) merges, report and log should both source cfg.Log.Path — a one-liner each in main.go.

🤖 Generated with Claude Code