Function evaluate_exec_mediation 

pub fn evaluate_exec_mediation(
    policy: &ExecMediationPolicy,
    cmd: &str,
    args: &[String],
) -> ExecMediationResult

Evaluate exec mediation policy for a command.

Called after capability-level policy allows exec, but before spawning. Returns ExecMediationResult indicating whether the command should proceed, be audited, or be denied.