feat(infra): port tool system ke TypeScript (37 tools + registry + executor)

Fase 3b rewrite Zesdex dari Rust ke TypeScript/Bun:
- Tool interface, ToolCtx + ToolCtxBuilder, InfrastructureToolExecutor
- Registry: allTools (37 tool), toolDefs, toolIsRisky, toolIsParallelSafe
- FS tools: read, write, edit, delete
- Search: grep, glob (glob matcher ringan)
- Shell: bash (timeout + timeout_spawn), bash_output, bash_kill
- Git: git_operator, git_worktree, git_cred + checkGitDestructive, checkCredentialRead
- Memory: remember, forget, recall via MarkdownMemoryRepository
- Utilitas: cd, dir_list, dir_cache_update, pong, todowrite, todofinish
- Best-practice: best_practice, commit_convention + BestPracticeEngine
- Web search (async fetch ke SearXNG), semantic_search/rebuild_index/list_symbols
- Workflow/spawn/parallel_delegate (delegasi ke engine 3c/3d dengan placeholder)
- Graduated checks + resolve_path sandbox (anti path-escape)
- 16 test tool system (registry, guards, resolve_path, fs roundtrip)

54 test hijau (38 lama + 16 baru), tsc strict bersih.

apps/packages/infrastructure/src/tools/git/git_operator.ts

@@ -0,0 +1,34 @@
+/** Git operator tool — safe git operations. Mirrors `tools/git/git_operator.rs`. */
+import type { JsonValue } from "@zesdex/domain";
+import { type Tool, type ToolCtx } from "../mod.ts";
+import { argStr, executeCmd, optStrArray } from "../util.ts";
+import { checkGitDestructive } from "../shell/git.ts";
+
+export class GitOperator implements Tool {
+  name = "git_operator";
+  description = "Execute git operations (commit, push, pull, branch, status, log, etc.)";
+
+  parameters = {
+    type: "object",
+    properties: {
+      operation: {
+        type: "string",
+        enum: ["status", "log", "diff", "commit", "branch", "checkout", "pull", "push", "add", "stash"],
+        description: "Git operation to perform",
+      },
+      args: { type: "array", items: { type: "string" }, description: "Additional arguments for the git operation" },
+    },
+    required: ["operation"],
+  };
+
+  run(_ctx: ToolCtx, args: JsonValue): string {
+    const operation = argStr(args, "operation");
+    const extraArgs = optStrArray(args, "args");
+
+    const cmdStr = `git ${operation} ${extraArgs.join(" ")}`;
+    const blocked = checkGitDestructive(cmdStr);
+    if (blocked) throw new Error(`blocked: ${blocked}`);
+
+    return executeCmd(["git", operation, ...extraArgs]);
+  }
+}