Fix Pi raw mode accepting compound shell commands

[just-a-node]

Summary

• reject hypa_shell calls that combine raw: true with shell operators, redirects, quoting, substitutions, escapes, or multiline input
• clarify the raw-mode restriction in the tool schema and prompt guidance
• retain raw passthrough for simple whitespace-tokenized executable arguments

Why

hypa raw receives an argv array after the user's interactive shell has parsed the command. The Pi adapter instead receives a command string and currently reconstructs argv with split(/\s+/). Although the implementation comment says complex syntax must use compressed mode, the tool contract does not communicate or enforce that restriction.

For example, this Pi call:

{"command":"mkdir fixture && cd fixture && git init","raw":true}

currently invokes mkdir with fixture, &&, cd, fixture, &&, git, and init as ordinary arguments. That can silently create unintended filesystem entries. The new validation fails before spawning Hypa and directs callers to omit raw, allowing compressed mode to own shell parsing.

Validation

• npm run build — passes
• npx tsx --test test/tools.test.ts — 24/24 pass
• npm test — the new tests pass; the suite retains 3 unrelated failures on unmodified main in bundled-native binary resolution tests (resolveBundledHypaBinary / resolveHypaBinary)

No CLI flags or core hypa raw behavior change; this only enforces the Pi adapter's existing documented-in-code restriction.