fix(toolkit): handle single-quoted grep patterns in claim-verification hook (DOJ-4872)

Round-3 bot review at 4/5 confidence flagged 1 P3: the pattern extractor
only handled double-quoted forms, so `grep -rn 'Symbol' src/` would fall
through to the awk fallback and (until the awk fallback also stripped
single quotes) emit `'Symbol'` with the quotes attached.

Applied:

- Added a second extractor branch that mirrors the double-quote form but
  for single-quoted patterns. Tries double-quote first (cheapest grep),
  then single-quote, then the multi-flag awk fallback.
- Extended `tr -d` in the awk fallback to strip both `"` and `'`, so the
  unquoted-token output is clean regardless of which quote style the
  original command used.

Verification:
  - shellcheck → 0 issues
  - "grep -rn 'Symbol' src/"      → "Symbol"  (was: 'Symbol')
  - "grep -rn \"Symbol\" src/"      → "Symbol"  (regression)
  - "grep -i -r 'Symbol' src/"    → "Symbol"  (new, multi-flag + single quote)
  - "grep -i -r \"Symbol\" src/"    → "Symbol"  (regression)
  - "ls src/foo.tsx"              → src/foo.tsx (regression)
  - "echo hello"                  → silent     (regression)

Created by Claude Code on behalf of @lapc506.

Author: lapc506

hooks/pre-tool-use-claim-verification.sh

@@ -165,16 +165,26 @@ if printf '%s' "$COMMAND" | grep -qE '(^|[;&|][[:space:]]*)ls([[:space:]]|$)'; t
     SUGGESTED="git fetch origin <branch> --quiet && git ls-tree origin/<branch> -- <path>"
   fi
 elif printf '%s' "$COMMAND" | grep -qE 'grep[[:space:]]+-[rRnliN]+'; then
+  # First try the double-quoted form: `grep -rn "Symbol" src/`.
   pattern_arg="$(printf '%s' "$COMMAND" \
     | grep -oE 'grep[[:space:]]+-[rRnliN]+[[:space:]]+"[^"]+"' \
     | head -1 \
     | sed -E 's/^grep[[:space:]]+-[rRnliN]+[[:space:]]+"(.+)"$/\1/')"
+  # Then the single-quoted form: `grep -rn 'Symbol' src/`.
+  if [ -z "$pattern_arg" ]; then
+    pattern_arg="$(printf '%s' "$COMMAND" \
+      | grep -oE "grep[[:space:]]+-[rRnliN]+[[:space:]]+'[^']+'" \
+      | head -1 \
+      | sed -E "s/^grep[[:space:]]+-[rRnliN]+[[:space:]]+'(.+)'$/\\1/")"
+  fi
   if [ -z "$pattern_arg" ]; then
     # Nested awk loop: skip subsequent flag tokens so multi-flag forms
     # like `grep -i -r "Symbol" src/` don't mis-extract `-r` as the pattern.
+    # Strip both " and ' so unquoted-token output is clean regardless of
+    # whether the original command used double or single quotes.
     pattern_arg="$(printf '%s' "$COMMAND" \
       | awk '{for(i=1;i<=NF;i++) if ($i ~ /^-[rRnliN]+$/) {for(j=i+1;j<=NF;j++) if ($j !~ /^-/) {print $j; exit}}}' \
-      | tr -d '"')"
+      | tr -d "\"'")"
   fi
   if [ -n "$pattern_arg" ]; then
     SUGGESTED="git fetch origin <branch> --quiet && git grep \"$pattern_arg\" origin/<branch> -- src/"