fix(rewrite): preserve stdin-driven commands

[YOMXXX]

Summary

• skip hook rewrites for stdin-sensitive commands such as wrangler secret put/bulk, kubectl/oc -f -, docker/podman build -, and git/yadm apply
• avoid rewriting upstream pipe producers when a downstream pipe segment consumes stdin
• skip rewrites for commands with input redirection while preserving normal file/context rewrites

Fixes #2431

Tests

• cargo +1.93.0 test registry -- --nocapture
• cargo +1.93.0 run --quiet -- rewrite "kubectl apply -f -"
• cargo +1.93.0 run --quiet -- rewrite "cat manifest.yaml | kubectl apply -f -"
• cargo +1.93.0 run --quiet -- rewrite "cat secret.json | wrangler secret bulk --name worker"
• cargo +1.93.0 run --quiet -- rewrite "kubectl apply -f manifest.yaml"
• cargo +1.93.0 run --quiet -- rewrite "docker build ."
• cargo +1.93.0 fmt --check
• git diff --check
• cargo +1.93.0 clippy --all-targets
• cargo +1.93.0 test --all -- --skip small_grep_not_worse_than_plain