bug: run() misuse across 8+ tools — shell commands silently failing

[TerminalGravity]

Summary

lib/git.ts run() uses execFileSync('git', args) — no shell, always prepends git. Many tools misuse it by passing shell strings with pipes, redirects, non-git commands, or redundant git prefixes. All these calls fail silently.

Fixed in #214: token-audit.ts, what-changed.ts

Still affected

File	Example broken call
verify-completion.ts	run('cat package.json 2>/dev/null') → git cat package.json
clarify-intent.ts	run('find tests ... 2>/dev/null | head -20') → git find ...
session-handoff.ts	run('command -v ...'), run('gh pr list ...') → git command, git gh
audit-workspace.ts	run('git diff ... 2>/dev/null') → double git + shell redirect
sharpen-followup.ts	run('git diff ... 2>/dev/null'), run('git status ... 2>/dev/null')
enrich-agent-task.ts	run('git ls-files ... | grep ... | head') → pipes don't work
sequence-tasks.ts	run('git ls-files 2>/dev/null | head -1000')
checkpoint.ts	run('git reset HEAD 2>/dev/null')
scope-work.ts	run('git ls-files | head -500 | grep ...') → pipes

Fix approach

Use the shell() helper added in #214 for commands needing pipes/redirects, or replace with Node fs APIs. For git commands, use run() with array args and no git prefix.