Add a `!` shell escape so users can run quick commands directly

## What happened

Tester asked for a way to run `!`-prefixed shell commands directly in the Orbit input, rather than prompting the agent to do it. Quote: "I frequently want to do things like `pwd` or `ls` and not having the agent do it would be sensible."

## Context

In the same session the agent spent multiple turns running trivial commands (`pwd`, `ls -la ..`, `find ... -name "*.md"`) on the user's behalf while hunting for a file -- slow, and it consumes model quota for things the user could type instantly.

## Expected vs actual

- Expected: a direct shell escape (e.g. `!pwd`) that runs in the analysis working dir and prints output without a model round-trip.
- Actual: every shell action must be mediated by the agent.

## Notes

Would also reduce model-quota burn from low-capability models thrashing on filesystem exploration (see related quota/exec-guard reports, #242). Should respect the same workspace boundary / exec-guard policy as agent-run bash.

## Sysinfo

Orbit 0.3.1 - darwin/arm64 - electron 41.2.1 - node 24.14.1 - provider google - model gemini-3.5-flash - galaxyConfigured true

Start by tracing Orbit input handling and the existing agent-run bash and exec-guard path. Verify how commands are run in the analysis working directory and how output is displayed. Done means !-prefixed commands run directly without a model round-trip while preserving the existing workspace boundary and exec-guard policy.

Written by the indexing model from the issue text.