Preflight the commands that definitions reference

Two of my three definition bugs were "this binary does not exist on this machine," and both were discovered at the worst possible moment:

• [checkpoint] command used pg_dump → discovered at first newgit checkpoint, exit 127, whole checkpoint aborted
• [restore] command used psql → would only have surfaced during an actual rollback

There is no Postgres client on this host; the database lives inside a container the Supabase CLI manages. That is the normal setup for the ecosystems these templates target (see #90).

newgit render --check (from #56) already establishes that cheap static validation with no instance and no spawn is something this tool believes in. The same move for commands:

$ newgit check
FAIL  supabase: [checkpoint] command references `pg_dump` — not found on PATH
FAIL  supabase: [restore] command references `psql` — not found on PATH
ok    supabase: [actions.prepare] `supabase` found

Extracting the leading binary of each &&-joined segment gets most of the value; it does not need to be a shell parser.

This pairs with the "restore never exercised" machinery from #42: a restore is unproven until it runs, and "the binary isn't installed" is the cheapest class of unproven to rule out in advance.

Distinct from #80, which asks to see the environment and rendered command a hook will run with. That shows me the string; this checks whether it can execute. #80 would have helped me diagnose faster; this would have stopped me shipping the bug.

Environment: newgit 0.3.0 (fba8fa7090e2), macOS 15 (Darwin 25.6.0), APFS. npm-workspaces monorepo (Expo/React Native + Next.js + Supabase); local stack is Supabase CLI 2.107.0 (12 containers, Docker Desktop 28.2.2), Metro, and a Dockerised routing service. 4 instances spawned over one session; resources deps (install), expo (process), supabase (command-snapshot-migrations), r5 (project-owned).

Start at the newgit check entry point and compare its validation path with the existing newgit render --check static validation. Trace how definition commands are represented, then verify that leading binaries from &&-joined segments are checked on PATH and that missing commands produce failures without spawning or requiring an instance.