replace shell-quote with regex-based command parsing

shell-quote is a quoting/escaping library, not a shell command parser.
Replace with a regex splitter that handles pipes, chains, subshells,
and parenthesized groups. Strips () from tokens via sanitizeToken.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/x/pnpm-lock.yaml

@@ -380,9 +380,6 @@ importers:
       react:
         specifier: ^19.2.3
         version: 19.2.3
-      shell-quote:
-        specifier: ^1.8.3
-        version: 1.8.3
       xlsx:
         specifier: ^0.18.5
         version: 0.18.5
@@ -402,9 +399,6 @@ importers:
       '@types/pdf-parse':
         specifier: ^1.1.5
         version: 1.1.5
-      '@types/shell-quote':
-        specifier: ^1.7.5
-        version: 1.7.5
 
   packages/shared:
     dependencies:
@@ -3352,9 +3346,6 @@ packages:
   '@types/responselike@1.0.3':
     resolution: {integrity: sha512-H/+L+UkTV33uf49PH5pCAUBVPNj2nDBXTN+qS1dOwyyg24l3CcicicCA7ca+HMvJBZcFgl5r8e+RR6elsb4Lyw==}
 
-  '@types/shell-quote@1.7.5':
-    resolution: {integrity: sha512-+UE8GAGRPbJVQDdxi16dgadcBfQ+KG2vgZhV1+3A1XmHbmwcdwhCUwIdy+d3pAGrbvgRoVSjeI9vOWyq376Yzw==}
-
   '@types/trusted-types@2.0.7':
     resolution: {integrity: sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==}
 
@@ -11114,8 +11105,6 @@ snapshots:
     dependencies:
       '@types/node': 25.0.3
 
-  '@types/shell-quote@1.7.5': {}
-
   '@types/trusted-types@2.0.7':
     optional: true