feat(tests): add shadow-classification lint; fix real cp/mv/less bugs

New Phase 1b in tests/run-tests.fish: catches a bare C1-shadowed-command
call in a functions/*.fish body with no matching uses-shadow(name) or
self-limiting(name) in that function's own CLASSIFICATION header. This
is exactly the check discussed after the rm and cd audits -- runtime
auto-unwrapping isn't viable in fish (there's no hook finer than
shadowing itself, and rewriting behavior invisibly at runtime is its
own footgun); a static lint using the CLASSIFICATION tag as the
declared-intentional marker is. Scoped to functions/*.fish only: the
one-function-per-file convention there makes body extraction exact
with no block-depth parser needed.

Added a new self-limiting(name) tag to the schema for the case a bare
call is safe not because the caller did anything, but because the
shadow's own logic already neutralizes the override: rm's and mkdir's
flag checks (verified precisely -- rm falls back to command rm for any
flag except a bare -r/-R/--recursive alone, which still routes to
trash; mkdir falls back to command mkdir -p for any flag, no
exception), and grep/fgrep/egrep/dir/vdir/cat's own tty auto-detection
(--color=auto, and bat's default color behavior -- verified
byte-identical to stock cat when piped, since bat also auto-disables
highlighting on a non-terminal). Explicit and durable rather than a
silent lint exemption: if a shadow's bypass condition is ever
weakened, every self-limiting site is one grep away instead of
silently wrong.

Running the first draft of the lint surfaced three more real bugs,
none previously audited:

- config-help.fish's --man pager path checks `type -q less` (proving
  it wants the real less binary specifically, for less-only -R/+N
  flag syntax) then called it bare, routing through our own
  $PAGER -> ov -> less -> more -> cat fallback chain instead -- which
  could hand those less-specific flags to a completely different
  program. Now command less.
- _fish_deps_install.fish and _fish_deps_update.fish's binary-upgrade
  paths cp a freshly downloaded binary over an already-installed one
  with no existence guard -- the update flow's target is guaranteed to
  already exist. Our cp shadow forces -i unconditionally (a plain
  alias, not flag-aware like rm's), so this would hang waiting on a
  confirmation prompt in any non-interactive run. Now command cp.
  Same two files' lazydocker install path piped curl output into bare
  bash, invoking our shell-switch wrapper instead of a plain
  subshell. Now command bash.
- agents-init.fish's AGENTS.md/CLAUDE.md relocation calls mv bare in
  four places; each is already guarded by a preceding test -f check on
  the destination, so the -i alias was unlikely to ever fire in
  practice, but explicit command mv removes the reliance on that guard
  entirely rather than leaving it as the only thing standing between a
  file move and an unattended hang.

The remaining ~65 flagged call sites across ~24 files were reviewed
individually and tagged self-limiting(rm)/self-limiting(mkdir)
(verified flagged with -f/-rf or -p) and self-limiting(grep)/
self-limiting(cat) (verified piped, captured, or -q/-c; none display
color to a human), plus uses-shadow(ls) for two existence-check-only
calls (cffetch.fish, ffetch.fish) whose output is redirected to
/dev/null.

functions/_fish_deps_install.fish

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
 # CLASSIFICATION
-#   destructive, network, blocking-prompt
+#   self-limiting(rm,mkdir,cat), bypasses-shadow(cp,bash), destructive, network, blocking-prompt
 #
 # SYNOPSIS
 #   _fish_deps_install
@@ -284,7 +284,7 @@ function _fish_deps_install
                     end
                     test $_go_status -eq 0
                 case special-lazydocker
-                    curl https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | bash
+                    curl https://raw.githubusercontent.com/jesseduffield/lazydocker/master/scripts/install_update_linux.sh | command bash
                 case special-marktext-paru
                     paru -S --noconfirm marktext-bin
                 case special-marktext-yay
@@ -312,7 +312,7 @@ function _fish_deps_install
                         -o "$_tmpdir/$_zip"
                     and unzip -o "$_tmpdir/$_zip" -d "$_tmpdir"
                     and mkdir -p "$_wt_dir" "$HOME/.local/bin"
-                    and cp "$_tmpdir/$_bin_src" "$_wt_bin"
+                    and command cp "$_tmpdir/$_bin_src" "$_wt_bin"
                     and chmod +x "$_wt_bin"
                     and ln -sf "$_wt_bin" "$HOME/.local/bin/wakatime"
                     rm -rf "$_tmpdir"
@@ -323,7 +323,7 @@ function _fish_deps_install
                     and curl -fL "https://github.com/equalsraf/win32yank/releases/latest/download/$_zip" \
                         -o "$_tmpdir/$_zip"
                     and unzip -o "$_tmpdir/$_zip" -d "$_tmpdir"
-                    and cp "$_tmpdir/win32yank.exe" "$HOME/.local/bin/win32yank.exe"
+                    and command cp "$_tmpdir/win32yank.exe" "$HOME/.local/bin/win32yank.exe"
                     and chmod +x "$HOME/.local/bin/win32yank.exe"
                     set -l _dl_status $status
                     rm -rf "$_tmpdir"