refactor(werkbank): extract soft-PLC provisioning + ICS probe into werkbank-exec (WB-04a)

Prep for the Werkbank Docker executor (sharang/werkbank#5): the dynamic-execution
logic has to be usable by the runner (a separate repo), so lift it out of the
agent into a shared crate.

New crate `werkbank-exec` (git-mv preserves history):
- src/ics/*        — the read-only industrial-protocol probe (Modbus/OPC-UA/
                     EtherNet-IP/portscan), moved verbatim.
- src/plc/*        — ephemeral soft-PLC provisioning (DockerSoftPlc), the OpenPLC
                     program-load client, and provision_and_test/extract_program.
- src/error.rs     — a crate-local ExecError, replacing the agent's AgentError.
- src/fingerprint.rs — compute_fingerprint (copied from the agent's dedup).
Depends only on compliance-core + compliance-dast, so the runner can pull it
without the agent's server stack.

compliance-agent consumes it:
- AgentError gains `Exec(#[from] werkbank_exec::ExecError)`.
- The orchestrator's ICS-probe + provision-and-test call sites point at
  werkbank_exec::{ics,plc}; the old pipeline::ics and plc::runtime modules are
  removed (the static PLC scanner stays).
- CI clippy-checks + tests the new crate.

Pure move + rename — no behaviour change. 27 moved tests pass in the new crate;
283 agent lib tests pass; clippy + fmt clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -107,6 +107,8 @@ jobs:
         run: cargo clippy -p compliance-dashboard --features web --no-default-features -- -D warnings
       - name: Clippy (mcp)
         run: cargo clippy -p compliance-mcp -- -D warnings
+      - name: Clippy (werkbank-exec)
+        run: cargo clippy -p werkbank-exec -- -D warnings
 
       # Security audit
       - name: Security Audit
@@ -115,8 +117,8 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # Tests (reuses compilation artifacts from clippy)
-      - name: Tests (core + agent)
-        run: cargo test -p compliance-core -p compliance-agent --lib
+      - name: Tests (core + agent + werkbank-exec)
+        run: cargo test -p compliance-core -p compliance-agent -p werkbank-exec --lib
       - name: Tests (dashboard server)
         run: cargo test -p compliance-dashboard --features server --no-default-features
       - name: Tests (dashboard web)