Widespread shell syntax in run() calls after execFileSync migration

[TerminalGravity]

Problem

run() in src/lib/git.ts uses execFileSync (no shell), but many tool files still pass shell syntax that silently breaks:

• Shell operators: ||, &&, |
• Redirects: 2>/dev/null, 2>&1
• Prefixing git in strings (becomes a literal arg since execFileSync('git', ['git', ...]))
• Shell quoting/escaping

Affected files

PR #109 fixes 3 files. These still need fixing:

• verify-completion.ts — cat, tsc --noEmit 2>&1 | tail, npm run build 2>&1 | tail
• token-audit.ts — wc -l, wc -c, tail -c, 2>/dev/null
• clarify-intent.ts — tsc --noEmit 2>&1 | grep, find ... | head
• session-handoff.ts — command -v, gh pr list ... || echo
• audit-workspace.ts — find ... | wc -l, 2>/dev/null
• enrich-agent-task.ts — git ls-files | grep, head -30
• scope-work.ts — git ls-files | head | grep
• sequence-tasks.ts — git ls-files | head

Options

1. Fix each caller to use array args + JS logic (like PR fix: shell syntax bugs in what-changed, checkpoint, session-health #109)
2. Add a shell() helper that uses execSync for commands that genuinely need shell features
3. Both — array args where simple, shell() for complex piping

Option 3 is probably best. Some commands (find | grep | head) are genuinely easier with shell.

[TerminalGravity]

PR #113 covers all the files listed here with a clean three-tier approach: array args for simple git commands, shell() for genuine pipe/redirect needs, and exec() for non-git binaries. Once that lands, the older fix PRs (#109, #111, #112, #101, #100) can be closed.

One thing to watch: the shell() helper defaults to a 10s timeout which might be tight for type-checking larger projects. Easy fix if it comes up.