fix(skills): make pre-resolution commands shell-portable so skills load under PowerShell

[LukeTheoJohnson]

Fixes #1066

Summary

The ! backtick pre-resolution lines in eight skills use bash-only syntax (2>/dev/null || true, || echo 'SENTINEL', || pwd). The harness executes these through the user's shell at skill load, and on Windows installs where that shell is PowerShell every one of these lines fails, even inside a git repo, so the skill breaks at load (#1066). This PR reduces each guarded line to a bare single command and moves the failure handling into the adjacent prose, which already told the agent what to do when a line does not resolve.

Current behavior

From #1066, invoking /ce-compound on Windows with a PowerShell-shelled harness:

/ce-compound
  Error: Shell command failed for pattern "!git rev-parse --abbrev-ref HEAD 2>/dev/null || true":
  Out-File: Could not find a part of the path 'D:\dev\null'.
  true: The term 'true' is not recognized as a name of a cmdlet, function, script file, or executable program.

Two independent failures: PowerShell resolves /dev/null as a literal file path (D:\dev\null), and true is not a command on Windows. PowerShell 5.1 additionally cannot parse || at all. So the guarded shape fails for these users on the happy path (inside a git repo), not just in the edge case the guard was written for.

Root cause

The 2>/dev/null || true guards were added for issue #730, when a failing pre-resolution aborted skill load on POSIX shells. The guard itself is bash-only syntax, so it trades a POSIX edge-case failure (outside a git repo) for a hard failure on every PowerShell-shelled Windows install.

Fix

• Reduce all ten guarded pre-resolution lines (ce-brainstorm, ce-commit, ce-commit-push-pr, ce-compound, ce-ideate, ce-plan, ce-product-pulse, ce-sweep) to bare single commands, e.g. !`git rev-parse --show-toplevel`. A bare command parses and runs in bash, PowerShell 5.1, and PowerShell 7.
• Extend the adjacent fallback prose from "if empty or still a backtick string" to also cover "shows an error", so the agent derives the value at runtime in every non-resolving case (outside a git repo, gh missing, origin/HEAD unset, PowerShell error text).
• Update tests/skill-shell-safety.test.ts: replace the superseded "pair 2>/dev/null with || true" checker, whose failure message now instructs contributors to write the exact shape that breaks PowerShell, with a checker that rejects redirects and ||/&& chains in pre-resolution commands outright. The policy header documents the incident and the succession from the [compound-engineering] Bug: ce-compound and ce-sessions fail with "Shell command failed for pattern" outside git repos #730 guidance.

The bare shape is not new to this repo. ce-commit and ce-commit-push-pr already ship bare pre-resolution lines (!`git status`, !`git diff HEAD`, !`git branch --show-current`, !`git log --oneline -10`) that fail outside a git repo the same way a bare git rev-parse does, and no #730-style reports have come in against them. Guarded and bare currently coexist across the skills; this PR converges on the shape that runs in every shell.

Verification

• Probed current harness behavior empirically with a scratch skill carrying both a guarded and a bare line (Claude Code on Windows):
  • In a git repo, !`git rev-parse --abbrev-ref HEAD` resolves to the branch name.
  • Outside a git repo, the failing bare line substitutes to an error string and the skill body still runs. A failing pre-resolution no longer aborts skill load on current Claude Code, which is the failure mode the [compound-engineering] Bug: ce-compound and ce-sessions fail with "Shell command failed for pattern" outside git repos #730-era guard was defending against; the updated fallback prose handles the error text.
• Red then green: with one skill temporarily restored to the guarded form, the new shell-safety check fails naming the exact file and line; on this branch the suite passes (93 tests, 0 fail).
• Full bun test baseline diff against main on this machine: zero new failures.
• One honest gap: this machine's Claude Code routes ! lines through git-bash, so the PowerShell execution path itself was not reproduced locally. The PowerShell claim rests on the reporter's error output in Cannot use /ce-compund on windows system for claude code, after upgrade to 3.17.1 version #1066 plus PowerShell semantics, each verifiable independently.

Scope notes

• The runtime "Context fallback" compound commands in ce-commit and ce-commit-push-pr (the printf chains with 2>/dev/null) are deliberately unchanged: agents run those adaptively through a shell tool at runtime and can translate per platform, unlike load-time pre-resolution, which the user cannot avoid.
• The bare shape re-exposes the [compound-engineering] Bug: ce-compound and ce-sessions fail with "Shell command failed for pattern" outside git repos #730 failure mode only on harness versions that still abort on a failing pre-resolution, and only outside a git repo. That is the same exposure the existing bare lines noted above have carried without reports.