fix(newos4): shell tokenises command lines quote-aware everywhere (v4.6.132)

v4.6.131 taught the pipe stages to forward their raw text, but the shell's own wrapper still split
each stage with `cmdText.split(/\s+/)` — so `grep "alpha beta" /qt.txt | wc -l` handed grep the two
args `"alpha` and `beta"` and matched nothing. Measured live: the wrapper (ShellModule.init() replaces
terminal.executePipeChain) is the implementation that runs, so the core fix alone is decorative.

All six command-line split sites in modules/ext/shell.js now go through one helper, `_tokenize()`,
which delegates to `security._parseArgs` — the parser the bare-command path already uses — so the two
cannot drift again:

  111  single command in a `&&` / `;` chain     -> `grep "a b" f ; echo done`
  176  pipe stage (the wrapper that runs)       -> `grep "a b" f | wc -l`
  358  `<` redirect input                       -> `cat < /f`
  401  pipe chain inside the script runner      -> also forwards the stage's raw text now
  424  single command in the script runner      -> also forwards raw text
  778  `[ -f "path" ]` / `test -f "path"`       -> quoted paths in test expressions

Empty stages are skipped instead of being dispatched as a command named '' (`help | | wc -l`).
The guard test grew the assertion that would have caught this: test-pipe-guard.js now checks
`shellTokensQuoted` (tokeniser used, no `cmdText.split(`, empty-stage guard present) alongside
`shellForwardsRaw`; both are RED against HEAD's shell.js.

Verification
  node modules/test/test-pipe-guard.js -> {"empty":[],"blank":[],"classifyGuarded":true,
      "pipeGuarded":true,"shellForwardsRaw":true,"shellTokensQuoted":true}
  node modules/test/test-parse-args.js -> 28/28 · daily job -> node tests 21/21 pass
  newos4-maintain.py -> maintenance result: OK (index 349, help 363/363, changelog v4.6.132)
  live v4.6.132, read from the terminal DOM (no print monkey-patch):
    cat /qt.txt                          -> alpha beta
    grep "alpha beta" /qt.txt            -> 1 match, 1 file
    grep "alpha beta" /qt.txt | wc -l    -> 2   (match line + summary; 1 when the quotes are lost)
    grep "alpha beta" /qt.txt ; echo done-> match count + done
    ShellModule._tokenize(c) === security._parseArgs(c) for 5 sample lines -> true
    _tokenize('') / _tokenize('   ')     -> [] / []

Also closes the last open feedback item: RPT-20261027-160751 ("Connection failed on all providers")
-> resolve, recorded in decisions.jsonl with evidence (headless probe URL `?probe=ctx`, v4.6.117,
single occurrence, no stack; Ollama answers 200 with 37 models now). Feedback queue: awaiting 0.

1 files changed, 1 insertions, 1 deletions

diff --git a/modules/core/module-loader.js b/modules/core/module-loader.js
index 3e50c3e..0d39123 100644
--- a/modules/core/module-loader.js
+++ b/modules/core/module-loader.js
@@ -4,7 +4,7 @@
     // Core module bundle loaded synchronously in main.html.
     // This loader only handles version cache-busting, splash, terminal init, and optional ext modules.
 
-    const LATEST_VER = 'v4.6.131';
+    const LATEST_VER = 'v4.6.132';
     const CACHE = '?v=' + LATEST_VER;
     // Exposed so ext modules can register their own URL with the same cache-busting version
     // instead of an unversioned path the browser may already have cached (shell.js did).