Improve protocol recovery for malformed tool calls and add Windows-aware shell guardrails

[mmprotest]

Motivation

• Prevent long-running loops when the assistant emits repeated malformed structured tool calls (e.g., empty Write {}) by recovering protocol discipline with a light corrective nudge.
• Avoid thrashing from shell commands that are clearly incompatible with the host environment, especially heredoc and bash-only forms on Windows.
• Keep behavior lightweight, local, and non-deterministic without adding end-of-run audits or fixed workflows.

Description

• Added per-run tracking and a small rolling-window policy in Runner to detect repeated malformed structured-tool failures keyed by tool name and emit a compact, tool-specific recovery message when the frequency threshold is reached, and clear the degraded state after a successful call (villani_code/state.py).
• Integrated the recovery injection so it is deduplicated and appended as a short user-content message; the message names the failing tool and asks for either one valid retry using the tool schema or a grounding action (inspect relevant files) without prescribing specific steps (villani_code/state.py).
• Added environment-aware shell preflight checks in the Bash tool path including environment detection, heredoc-pattern rejection for Windows, narrow bash-specific-pattern rejection for Windows cmd/PowerShell, and conservative command-length guards; these return concise rejection reasons before execution (villani_code/tools.py).
• Kept changes local and focused, reusing existing error/event plumbing, and avoided any deterministic control flow, completion audits, or forced planning.
• Files changed: villani_code/state.py, villani_code/tools.py, tests/test_loop.py, tests/test_tools_hardening.py.

Testing

• Ran pytest -q tests/test_loop.py tests/test_tools_hardening.py which executes added unit tests for repeated malformed Write recovery, recovery-state clearing after a valid call, Windows heredoc rejection, non-Windows permissiveness, bash-specific rejection on Windows, and command-length guard behavior.
• Result: the test run passed (34 passed).

---

Codex Task