fix(rewrite): preserve newline separators in compound commands

[mpecan]

Summary

Multi-line bash commands going through the tokf hook used to glue adjacent segments together when at least one was rewritten. With a head -N pipe in one line, this produced malformed output like head -1echo > 1echo 2>&1 — the shell created a stray file in the agent's cwd before the malformed flag errored out.

# Before fix:
$ tokf rewrite "$(printf 'cargo test\nls | head -1\necho hi')"
tokf run cargo testtokf run --baseline-pipe 'head -1' lsecho hi

# After fix:
$ tokf rewrite "$(printf 'cargo test\nls | head -1\necho hi')"
tokf run cargo test
tokf run --baseline-pipe 'head -1' ls
echo hi

Root cause

compound_segments iterated every top-level rable AST node with a hard-coded empty parent_sep. rable parses cmd1\ncmd2 as two top-level nodes (not a List with a Newline operator), so the newline separator was dropped during reassembly. The fix slices the source between consecutive node spans byte-for-byte, capturing \n/;/whitespace/comments verbatim.

Diagnostic logging

Also adds TOKF_HOOK_LOG=/path/to/hook.log (off by default). When set, every tokf hook handle invocation appends one YAML record covering BEFORE / AFTER / outcome. This was the reporter's explicit ask: bugs that only manifest in live AI-tool sessions are otherwise invisible — tokf rewrite "..." won't reproduce them when the test command isn't multi-segment with a filter match. Documented in docs/diagnostics.md.

Closes #355

Test plan

• cargo fmt -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace — 2190 passed
• New unit tests in bash_ast_tests.rs: separator preservation, byte-for-byte round-trip across &&/||/;/newline/heredoc/line-continuation
• New integration test in rewrite/tests.rs: explicit Hook creates stray 1<cmd> files in cwd from misformed head -1<word> rewrite #355 reproducer with filter-matched segments
• New integration tests in cli_hook_handle.rs (7 cases): TOKF_HOOK_LOG records Allow/PassThrough/Ask, multi-line command preserved verbatim, stray-file shape negated, no log when env unset/empty, unwritable path doesn't block hook
• Inline unit tests in debug_log.rs for the YAML formatter (multi-line indenting, all hook formats, empty input)
• Verified locally that tokf rewrite of the canonical reproducer now emits separator-preserved output

🤖 Generated with Claude Code

[repository-butler]

Filter Verification Report

Changed Filters

No filter files changed in this PR.

All Filters Summary

✅ 143/143 test cases passed across 51 filters

---

_{Generated by tokf verify}