feat(shell): support |, &&, ||, ; chain operators in run_command

[esengine]

Closes #232. Addresses discussion #231.

What changes

run_command now supports the four most common chain operators: |, &&, ||, ;. Each segment is parsed via shell-quote and spawned as a separate process — no system shell is ever invoked.

git status | grep main           # pipe — wired stdout→stdin
node -v && cargo check           # AND — short-circuit on non-zero
node -v || echo "node missing"   # OR — short-circuit on zero
mkdir tmp ; ls tmp               # sequence — always continue

Why not just shell: true

The four shells we'd hand the string to disagree on the basics:

Operator	bash/zsh	PowerShell 5.1	PowerShell 7+	cmd.exe
|	bytes	objects, not bytes	objects	bytes
&& ||	yes	parse error	yes	yes
;	yes	yes	yes	no
2>&1	merge	wraps stderr as ErrorRecord	same	merge

PowerShell 5.1 (the default on Windows 10/11) literally parse-errors on &&, so a shell-passthrough path would break node -v && npm test for every Windows user. Parsing ourselves and spawning each segment sidesteps the whole zoo — semantics are identical on every OS.

Granular allowlist (the bit @wviana asked for)

Each segment is allowlist-checked independently: git status | grep main auto-runs because both halves are individually allowed. Previously the whole string was checked as one prefix and never matched.

isCommandAllowed("git status | grep main")  // → true
isCommandAllowed("git status | rm -rf dist") // → false (rm not allowed)

Out of scope (rejected with a clear error)

• Redirects (>, <, 2>&1, &>) — Phase 2 will implement these as stream piping, still no shell.
• Background & — doesn't fit run_command's synchronous model; use run_background.
• Env-var expansion \$VAR — pass values literally or use the binary's own flags.
• Command substitution \$(…) and subshells (…) — split into separate calls.
• Glob expansion *.ts — passed through as a literal argument; tools like grep -r / rg / find already glob themselves.

Compatibility note

The strict POSIX parser disagrees with the previous lenient tokenizer in one edge case: an unquoted & mid-token (cargo run -- --flag=1&2) used to pass through as a single argv. It now rejects with "&" is not supported. The fix is to quote: cargo run -- "--flag=1&2". This is the POSIX-correct form and matches what every real shell would do.

Test plan

• 29 new tests in tests/shell-chain.test.ts covering parser, allowlist, pipe wiring, &&/|| short-circuit, ; sequence, exit-code propagation, stderr merge, timeouts, dispatch integration.
• Existing 7 rejection tests in tests/shell-tools.test.ts updated to reflect chain ops being supported and redirects / & / \$VAR / \$(...) / empty-segment / trailing-op being rejected.
• npm run verify — 2198 tests pass, no biome / typecheck errors on changed files.