fix: make shim validation safe and accurate

[rudijetson]

Summary

• resolve assigned shim targets before validating them
• accept only executable files, not executable directories or documentation
• use explicit command and argument boundaries for shim checks and repairs
• preserve unmanaged wrappers that cannot be validated safely
• add focused core and command-level regression coverage

Closes #15.

Verification

• focused shim tests: 8 passed, 0 failed
• pnpm test: 655 passed, 0 failed
• pnpm build: passed; tracked bundle reproduced cleanly after commit
• debt scan: 0 findings
• npm pack --dry-run --json: passed with 6 expected package files
• git diff --check: passed

Stack

This PR is intentionally based on codex/codex-standalone-ownership (#14), because both concerns regenerate dist/index.cjs. After #14 lands, retarget this PR to main; its two-commit diff is otherwise independent.