security: audit Command call sites; confirm no argument injection

Closes #18

All six Command::new call sites audited:
- bitwarden.rs (sh -c): shell string is a hardcoded literal; no user data.
- bitwarden.rs (bw unlock): all args hardcoded.
- bitwarden.rs (bw get): item_name and session passed as discrete .args() elements; no shell.
- nothooks/runner.rs (nu/sh/etc): interp and script path passed as discrete args; no shell.
- notstrap/repo.rs (git clone): url and dest passed as discrete .arg() calls; no shell.
- notfiles/tests/integration.rs: test harness with hardcoded args only.

Added SAFETY comments on the three sites that handle user-controlled config values.

crates/notstrap/src/repo.rs

@@ -6,6 +6,9 @@ pub fn clone_if_missing(url: &str, dest: &Path) -> Result<bool> {
     if dest.exists() {
         return Ok(false);
     }
+    // SAFETY: `url` comes from the notstrap.toml config and `dest` is a `Path` derived from
+    // the resolved dotfiles directory. Both are passed as discrete `.arg()` calls with no
+    // shell involved, so argument injection is not possible.
     let status = Command::new("git")
         .arg("clone")
         .arg(url)