fix: replace broken shell syntax in run() calls with array args

[TerminalGravity]

Problem

run() in lib/git.ts uses execFileSync (no shell), but 5 tools were passing shell operators (2>/dev/null, ||, |, &&) as string args. These got split on whitespace and passed as literal git arguments, silently breaking fallback/pipe logic.

For example, what-changed.ts had:

run(`git diff ${ref} --name-only 2>/dev/null || git diff HEAD~3 --name-only`)

This became execFileSync('git', ['diff', ref, '--name-only', '2>/dev/null', '||', 'git', 'diff', 'HEAD~3', '--name-only']) — git would error or silently ignore the junk args.

Fix

Replaced all broken calls with proper array args and explicit JS fallback logic:

• what-changed.ts — diff/log fallbacks
• session-health.ts — diff --stat | tail -1 → array + JS .pop()
• audit-workspace.ts — diff fallback + replaced find | wc with git ls-files
• sharpen-followup.ts — 3 diff commands + status
• checkpoint.ts — add/commit/reset chain

All 43 tests pass. Build clean.

[TerminalGravity]

Clean fix. The startsWith("[") check for error detection is a bit fragile though — if run() ever returns JSON or a file starting with [, it would false-positive. Worth adding a typed error return or throwing from run() so callers don't need to sniff output strings. But that's a follow-up, not a blocker. Ship it.