Closes #4252

Problem

On Windows, an undeletable file named nul keeps appearing in the workspace root. It can't be removed by Explorer or cmd (reserved device name) — only rm from git bash works — and it breaks builds and git operations.

Root cause

The model frequently appends the Windows cmd idiom 2>nul / >nul to discard output. reasonix runs shell commands under bash or PowerShell, never cmd.exe. Only cmd.exe treats nul as the null device — bash and PowerShell treat it as an ordinary filename, so 2>nul literally creates a file called nul in the cwd (the workspace root).

Reproduced on this box:

$ bash -c "echo hi 2>nul"          # → creates ./nul
PS> echo hi > /dev/null                  # → creates ./nul

Fix

Normalize cmd-style nul redirects (>nul, 2>nul, 1>>NUL, &>nul, …) to the target shell's real null device — /dev/null for bash, $null for PowerShell — in Shell.argv, the single point every shell invocation funnels through. Non-redirect uses of the word (echo nul, grep nul file, cat nul.txt, rm nul) are left untouched (RE2 has no lookahead, so the trailing delimiter is captured and re-emitted).

Validation

• Unit test TestNormalizeNulRedirect (rewrite cases + negatives) and TestArgvNormalizesNulRedirect.
• E2E: the rewritten form (echo hi 2>/dev/null / 2>$null) creates no nul file under bash or PowerShell, whereas the original 2>nul did.
• go test ./internal/sandbox/ + go vet pass.