refactor(executors): reimplement the Aider adapter independently

[bkd-dotcom]

Resolves the provenance question I flagged in #99, and removes the last @adity982 reference from the repo and the v0.7.0 changelog entry.

Why

The adapter merged in #96 was a port of an unsigned contribution (#55). Without a signed CLA the copyright assignment never happened — so keeping derived code while removing the attribution was the least defensible of the available options.

This rewrites aider.py from the sibling adapters (codex.py, claude_code.py — both owner-authored), so nothing in the tree derives from an unassigned contribution.

Behaviour is unchanged

All 33 executor tests pass without modification, including the 13 written against the previous implementation — they assert behaviour (fail-closed gating, diff capture, withheld authority, redaction, honest unavailable on failure, model pass-through), not structure. That's the evidence the rewrite is equivalent rather than merely compiling.

Two things it adds

Both are house patterns the port lacked:

1. is validated before use, like the Codex adapter's -m, so a caller-supplied value can't smuggle shell metacharacters or extra arguments into the command.

Worth noting how the boundary got found — my own new test caught it:

_SAFE_MODEL = re.compile(r"[A-Za-z0-9._:/-]{1,96}")     # accepts "--dangerously-x"

- is legal inside a model name, so a naive character class lets a leading-dash value through, and an argument parser may read that as a new option rather than as --model's value. The first character must now be alphanumeric:

value	result
bad;rm -rf /	rejected
a b c	rejected
--dangerously-do-x	rejected (was accepted)
gpt-5.6-terra	accepted
openrouter/anthropic/claude-opus-5	accepted

2. The withheld-authority flags are a named constant (_WITHHELD_AUTHORITY), so dropping one surfaces in review instead of vanishing into the command construction. A test asserts the whole set as a set.

Also logs a non-zero exit the way claude_code.py does, which the port didn't.

Verification

280 tests pass, ruff clean. Zero adity982 references remain anywhere in the repo.

After this, #55 can be closed — I'll do that once this lands, with an explanation of the CLA requirement rather than a bare close.

[github-actions]

Signetry Reviewer — 🟡 Needs human review

A human should decide — the required check is pending.

Deterministic gates (the authority)

Gate	Status
Required status check	⏳ pending
Secret scan	✅ clean
CI permission / OIDC	✅ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings

No issues found by the deterministic scanners.

Merge

A human should review and merge.

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.