feat: fix 7 read-only gaps found by audit log analysis

[grams]

Summary

Fixes found by replaying blocked audit-log entries through --audit: real commands that were being denied despite doing nothing but read.

• gh api graphql: checked by GraphQL operation type (mutation/subscription anywhere in the document, or an operationName field) instead of the REST write-method heuristic, which doesn't apply since the query document is itself passed as a -f/-F field. Endpoint detection uses a dedicated flags-with-value map so a flag's own value (e.g. graphql passed to -X/--preview) can't be mistaken for the endpoint and skip the write-method check.
• gcloud run <resource> <verb> (including behind alpha/beta) no longer swept into the generic run write-verb blacklist; its own verb is checked at its expected position. auth application-default restricted to the read-only token printers.
• git reset: non-destructive forms (no mode flag, --soft, --mixed) allowed via a flag allowlist rather than blacklisting --hard/--merge/--keep — git accepts unambiguous abbreviations (--har for --hard) that a blacklist misses.
• npx: strips a trailing @version before matching the allowlist (prettier@3), left untouched for alias/path/URL references (prettier@npm:x) which aren't a version.
• systemctl show/list-timers and comm added (read-only).
• uv run --with-requirements <file> -- <cmd> left as-is: the real subcommand sits after --, which every allowlisted tool treats as a hard stop on purpose (tested elsewhere against smuggling a value past a positional check).

Test plan

• go build ./... && go vet ./... && go test ./...
• gofmt -l . clean
• Local review: pr-review-toolkit:code-reviewer (3 rounds — found and fixed real bypasses: GraphQL mutation-detection evasion via leading comment/fragment/comma and operationName, gh api endpoint-detection shadowing via -X/--preview values, npm alias/file/git-URL references treated as a version, Cloud Run write verbs reachable via an unrecognized flag shifting token positions, glued-form -f/-F REST fields) + Kilroy (clean, one comment tightened)
• Empirically verified against real git/gh/gcloud/npx binaries, not just unit tests
• Scope check: stopped chasing further pflag short-flag-clustering bypasses (gh api -if title=pwned) — this tool targets prompt reduction for commands an LLM writes innocently, not hardening against a deliberately adversarial one (already the file's stated posture: "best-effort filter, not a security boundary")