security: audit Command call sites; confirm no argument injection

Closes #18

All six Command::new call sites audited:
- bitwarden.rs (sh -c): shell string is a hardcoded literal; no user data.
- bitwarden.rs (bw unlock): all args hardcoded.
- bitwarden.rs (bw get): item_name and session passed as discrete .args() elements; no shell.
- nothooks/runner.rs (nu/sh/etc): interp and script path passed as discrete args; no shell.
- notstrap/repo.rs (git clone): url and dest passed as discrete .arg() calls; no shell.
- notfiles/tests/integration.rs: test harness with hardcoded args only.

Added SAFETY comments on the three sites that handle user-controlled config values.

crates/notsecrets/src/sources/bitwarden.rs

@@ -83,6 +83,9 @@ impl BitwardenSource {
             session
         };
 
+        // SAFETY: `item_name` and `session` are user-controlled values (config item name and
+        // BW_SESSION env var / bw-unlock stdout), but are passed as discrete `.args()` elements,
+        // not interpolated into a shell string. No shell is involved, so injection is not possible.
         let output = Command::new("bw")
             .args(["get", "notes", &self.item_name, "--session", &session])
             .output()