Repair shim validation safety and accuracy

[rudijetson]

Problem

Shim validation currently relies on shell-oriented command handling and imprecise target checks. That can mis-handle literal paths and arguments and report inaccurate repair guidance.

Scope

• make shim validation use explicit command and argument boundaries
• verify expected shim targets accurately
• add focused unit coverage for core and CLI command behavior
• refresh the generated CLI bundle from the verified source

Constraints

• no mutation of the follower Mac dirty primary CLI checkout
• publish from an isolated worktree
• keep this concern separate from Codex standalone ownership

Acceptance

• focused shim tests pass
• full CLI suite passes
• build reproduces tracked bundle output
• debt scan and package dry run pass
• PR contains only the shim repair, its tests and checklist, and generated bundle

Implementation checklist: docs/swe-compliance/2026-08-05-shim-validation-repair.md.