fix: use shell() for commands requiring pipes/redirects, fix run() misuse across 11 tools

[TerminalGravity]

Problem

Multiple tools were passing shell syntax (pipes, redirects, ||, 2>/dev/null) and non-git commands (find, wc, cat, head) to the git run() function, which uses execFileSync('git', args) — no shell interpretation.

This caused:

• Shell operators becoming literal git arguments (silent failures/garbled output)
• Non-git commands being prepended with git (e.g., git cat package.json)
• Commands already starting with git getting doubled (git git diff ...)

Affected tools: audit-workspace, checkpoint, clarify-intent, enrich-agent-task, sequence-tasks, session-handoff, sharpen-followup, token-audit, verify-completion, what-changed (11 files)

Fix

• Added shell() helper in lib/git.ts for commands needing shell features (pipes, redirects, non-git commands)
• Fixed all tool files to use the correct execution method:
  • Simple git commands → run(['arg1', 'arg2']) (array form, safe)
  • Complex pipelines / non-git commands → shell('cmd | cmd2')
  • File reads → fs.readFileSync (verify-completion.ts)

Verification

• tsc --noEmit: clean
• vitest run: 43/43 tests pass
• eslint: no new warnings