✨ feat(mq-lang,mq-run): add process-io capability and system() builtin

[harehare]

Summary

Adds a Deno --allow-run-style permission: a new process-io feature flag, Io::execute()/SandboxedIo::allow_run() (default-deny, like read/write/net), and a system(command, args) builtin that runs a child process directly (never through a shell). Wired into mq-run via a new --allow-run flag.

Type of Change

• 🐛 Bug fix
• ✨ New feature
• ♻️ Refactor
• 📝 Documentation
• ⚡ Performance
• ✅ Test
• 📦 Build / dependencies
• 👷 CI

Checklist

• I ran cargo fmt and cargo clippy and addressed any warnings
• I ran just test-all and all tests pass
• I added or updated tests covering this change
• I updated relevant documentation (/docs, crate README.md) if needed
• I added a changelog entry if this is a user-facing change

Additional Context

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing feat/allow-run-system (579973e) with main (6469584)}