feat(provider): add Claude Code CLI provider

[aurokin]

Author Note: The intent of this PR is to add Claude Code CLI support to Clawpatch. Even with upcoming Claude Code changes, claude -p remains useful for review workflows. I spent time reading the Claude CLI docs, probing the CLI behavior directly, reviewing the implementation as it was built, and dogfooding this build while reviewing the final PR with Clawpatch using both Codex and Claude.

Summary

Adds a claude provider backed by the local Claude Code CLI in non-interactive print mode.

This includes:

• Provider selection via --provider claude / CLAWPATCH_PROVIDER=claude
• Claude-backed map, review, fix, and revalidate
• doctor --provider claude support
• JSON-schema structured output parsing via Claude structured_output
• Model pass-through with --model
• Reasoning effort mapping:
  • minimal -> Claude low
  • none omitted
  • low|medium|high|xhigh passed through
• Read-only operations restricted to Read,Grep,Glob
• Fix operations using Claude default tools with acceptEdits
• Ambient config isolation using --bare, empty MCP config, no slash commands, and no Chrome
• Default-deny environment forwarding only minimal execution variables and ANTHROPIC_API_KEY
• Known vulnerable Claude Code version blocking
• Claude provider documentation in docs/providers.md, docs/safety.md, and README.md

Also fixes a small command-execution race in runCommandRaw by adding the same single-settlement guard already used by runCommandArgs, plus direct coverage for the exported runCommand wrapper.

Validation

Ran:

• pnpm format:check
• pnpm typecheck
• pnpm lint
• pnpm test
• pnpm build

Dogfooded the built CLI against this branch as a PR-to-upstream/main check:

• doctor --provider codex passed
• doctor --provider claude --model claude-haiku-4-5-20251001 passed
• map --source agent --provider codex passed
• map --source agent --provider claude --model claude-haiku-4-5-20251001 passed with CLAWPATCH_CLAUDE_TIMEOUT_MS=600000
• review --since upstream/main --provider claude --model claude-haiku-4-5-20251001 --limit 3 --jobs 1 passed and surfaced one relevant docs issue, which is fixed in this branch

Notes from dogfooding:

• Codex review execution completed, but some provider responses failed Clawpatch's strict evidence validation. No integration crash or state issue was observed.
• Claude Haiku review completed the scoped run successfully. One unrelated existing revalidate help/error wording issue was reported and left out of scope.

[steipete]

claude is not a good review harness. Use a better model!

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: feat(provider): add Claude Code CLI provider This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.