fix(toolkit): robust ls/grep argument extraction in claim-verification hook (DOJ-4872)

Round-2 bot review at 4/5 confidence flagged 2 P3 polish items on the
suggester's argument extraction. Both addressed; suggestions applied
verbatim with explanatory comments.

P3 — hooks/pre-tool-use-claim-verification.sh:145 (ls path extraction)
  - Old: sed prefix-strip + awk first-token, which fails on commands
    like `ls -la` (no path arg, trailing flags) — sed regex `-flags`
    requires a trailing space, so the flags leak through and `-la` ends
    up as the "path arg" in the suggested replacement.
  - New: awk-only nested loop that locates the literal `ls` token,
    then walks forward skipping any token starting with `-`, and
    emits the first non-flag token. Empty when only flags are present
    (correct), so the suggester falls through to the `<path>` placeholder.

P3 — hooks/pre-tool-use-claim-verification.sh:158 (grep pattern extraction)
  - Old: awk fallback matched the first `-FLAGS` token and emitted the
    immediately following token, which on `grep -i -r "Symbol" src/`
    is `-r` — wrong.
  - New: nested awk loop that, after finding the flag token, walks
    forward skipping additional flag tokens before emitting the first
    non-flag one. Correctly isolates `Symbol` for `grep -i -r "Symbol"`,
    still correct for the single-flag-block form `grep -rn "Symbol"`.

Verification:
  - shellcheck → 0 issues
  - "ls -la"                 → suggester emits <path> placeholder (was: `-la`)
  - "ls src/foo.tsx"         → suggester emits `src/foo.tsx` (regression)
  - "grep -i -r \"Symbol\" src/" → emits "Symbol" (was: `-r`)
  - "grep -rn \"Symbol\" src/"   → emits "Symbol" (regression)
  - "echo hello"             → silent (regression)

Created by Claude Code on behalf of @lapc506.

Author: lapc506

hooks/pre-tool-use-claim-verification.sh

@@ -154,10 +154,11 @@ fi
 # Best-effort suggested replacement, branched by detected op.
 SUGGESTED=""
 if printf '%s' "$COMMAND" | grep -qE '(^|[;&|][[:space:]]*)ls([[:space:]]|$)'; then
-  # Extract the path argument (best-effort, first non-flag token after ls).
+  # Extract the path argument: first non-flag token AFTER `ls`. Awk-only
+  # avoids the trailing-flag-without-space edge case (`ls -la` would have
+  # leaked `-la` through the sed prefix-strip).
   path_arg="$(printf '%s' "$COMMAND" \
-    | sed -E 's/^.*ls[[:space:]]+(-[A-Za-z]+[[:space:]]+)*//' \
-    | awk '{print $1}')"
+    | awk '{for(i=1;i<=NF;i++) if ($i == "ls") {for(j=i+1;j<=NF;j++) if ($j !~ /^-/) {print $j; exit}}}')"
   if [ -n "$path_arg" ]; then
     SUGGESTED="git fetch origin <branch> --quiet && git ls-tree origin/<branch> -- $path_arg"
   else
@@ -169,8 +170,10 @@ elif printf '%s' "$COMMAND" | grep -qE 'grep[[:space:]]+-[rRnliN]+'; then
     | head -1 \
     | sed -E 's/^grep[[:space:]]+-[rRnliN]+[[:space:]]+"(.+)"$/\1/')"
   if [ -z "$pattern_arg" ]; then
+    # Nested awk loop: skip subsequent flag tokens so multi-flag forms
+    # like `grep -i -r "Symbol" src/` don't mis-extract `-r` as the pattern.
     pattern_arg="$(printf '%s' "$COMMAND" \
-      | awk '{for(i=1;i<=NF;i++) if ($i ~ /^-[rRnliN]+$/) {print $(i+1); exit}}' \
+      | awk '{for(i=1;i<=NF;i++) if ($i ~ /^-[rRnliN]+$/) {for(j=i+1;j<=NF;j++) if ($j !~ /^-/) {print $j; exit}}}' \
       | tr -d '"')"
   fi
   if [ -n "$pattern_arg" ]; then