fix(tools): replace shell syntax in run() calls with shell()/exec()/array args

[TerminalGravity]

Fixes #110. Converts all tool files that were passing shell syntax (pipes, redirects, ||, &&) to run() (which uses execFileSync without a shell) to use the appropriate helper:

• shell() for commands needing pipes, redirects, || fallbacks
• run([...args]) array syntax for simple git commands (removing unnecessary 2>/dev/null since run() already captures stderr)
• readFileSync where we were shelling out to cat

Files fixed: verify-completion, token-audit, clarify-intent, session-handoff, audit-workspace, sharpen-followup, what-changed, scope-work, session-health, enrich-agent-task, checkpoint, sequence-tasks

[TerminalGravity]

Solid approach — the three-tier strategy (array args for simple git, shell() for pipes/redirects, exec() for non-git binaries) is clean. The security comment on shell() is appreciated.

A couple notes:

• The shellEscape() mention in the JSDoc — is that implemented somewhere? Didn't see it in the diff. Might want to either add it or remove the reference to avoid confusion.
• Timeout default of 10s in shell() seems tight for pnpm tsc --noEmit on larger projects. Worth bumping or making configurable per-call.

This supersedes #109, #111, #112, #101, #100 — those should be closed once this lands. 🚀

[TerminalGravity]

Closing — superseded by #116 which covers all files with the cleaner three-tier approach.