Shell syntax passed to run() across multiple tools

[TerminalGravity]

Bug

run() in src/lib/git.ts uses execFileSync (no shell), but many tools pass strings containing shell syntax like 2>/dev/null, ||, pipes, and < file redirects. These get split on whitespace and passed as literal git args, causing silent failures.

Affected files

• src/tools/token-audit.ts — 2>/dev/null, wc -l < file
• src/tools/enrich-agent-task.ts — grep pipes, 2>/dev/null
• src/tools/clarify-intent.ts — pnpm tsc --noEmit 2>&1 | grep, find ... 2>/dev/null
• src/tools/audit-workspace.ts — 2>/dev/null, find ... | wc -l
• src/tools/sharpen-followup.ts — 2>/dev/null
• src/tools/session-handoff.ts — command -v ... 2>/dev/null, || echo
• src/tools/sequence-tasks.ts — git ls-files 2>/dev/null | head
• src/tools/checkpoint.ts — git reset HEAD 2>/dev/null
• src/tools/scan-sessions.ts — various

Fix

Each call needs to be converted to use array args with run(), and non-git commands (wc, find, grep) need their own execFileSync calls or Node.js equivalents.

PR #301 fixes what-changed.ts as a start.