Running ControlSpec — Before an agent acts 🧠Exact-action approval and evidence, alongside OpenShell