fix(pregate): spawn the supervised shell through lib/script-invocation (#3197 tripwire)

The supervisor now resolves bash via bashCommandInvocation, so Windows uses
Git Bash instead of a PATH bash, and an unresolvable bash reports spawn-failed.
guards.ts and lanes.ts no longer spawn bash (they run through supervise.ts),
so their KNOWN_SITES entries are removed.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/script-invocation-tripwire.test.ts

@@ -23,8 +23,6 @@ const SPAWN_BARE_BASH = /\b(?:spawn|spawnSync|execFile|execFileSync|execSync)\(\
 const COMMENT = /^\s*(?:\/\/|\*|\/\*)/;
 
 const KNOWN_SITES: Record<string, string> = {
-  'lib/pregate/checks/guards.ts': 'PR 5 (a #3190 file): repo guard commands move to runBashSync',
-  'lib/pregate/checks/lanes.ts': 'PR 5 (a #3190 file): the lane runner moves to runBashSync',
   'lib/evidence-bundle.ts': 'outside this wave: bundle replay commands (bash -lc) move to runBashSync',
   'bin/gstack-brain-context-load.ts': 'outside this wave: the brain context loader moves to runBashSync',
   'bin/gstack-issue-links': 'outside this wave: the gstack-issue-guard spawn moves to runScriptSync',