refactor: extract ExecWithOutput utility for command execution (gt-vurfr)

Create util.ExecWithOutput and util.ExecRun to consolidate repeated
exec.Command patterns across witness/handlers.go and refinery/manager.go.

Changes:
- Add internal/util/exec.go with ExecWithOutput (returns stdout) and
  ExecRun (runs command without output)
- Refactor witness/handlers.go to use utility functions (7 call sites)
- Refactor refinery/manager.go, removing unused gitRun/gitOutput methods
- Add comprehensive tests in exec_test.go

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

internal/util/exec_test.go

@@ -0,0 +1,67 @@
+package util
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestExecWithOutput(t *testing.T) {
+	// Test successful command
+	output, err := ExecWithOutput(".", "echo", "hello")
+	if err != nil {
+		t.Fatalf("ExecWithOutput failed: %v", err)
+	}
+	if output != "hello" {
+		t.Errorf("expected 'hello', got %q", output)
+	}
+
+	// Test command that fails
+	_, err = ExecWithOutput(".", "false")
+	if err == nil {
+		t.Error("expected error for failing command")
+	}
+}
+
+func TestExecRun(t *testing.T) {
+	// Test successful command
+	err := ExecRun(".", "true")
+	if err != nil {
+		t.Fatalf("ExecRun failed: %v", err)
+	}
+
+	// Test command that fails
+	err = ExecRun(".", "false")
+	if err == nil {
+		t.Error("expected error for failing command")
+	}
+}
+
+func TestExecWithOutput_WorkDir(t *testing.T) {
+	// Create a temp directory
+	tmpDir, err := os.MkdirTemp("", "exec-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Test that workDir is respected
+	output, err := ExecWithOutput(tmpDir, "pwd")
+	if err != nil {
+		t.Fatalf("ExecWithOutput failed: %v", err)
+	}
+	if !strings.Contains(output, tmpDir) && !strings.Contains(tmpDir, output) {
+		t.Errorf("expected output to contain %q, got %q", tmpDir, output)
+	}
+}
+
+func TestExecWithOutput_StderrInError(t *testing.T) {
+	// Test that stderr is captured in error
+	_, err := ExecWithOutput(".", "sh", "-c", "echo 'error message' >&2; exit 1")
+	if err == nil {
+		t.Error("expected error")
+	}
+	if !strings.Contains(err.Error(), "error message") {
+		t.Errorf("expected error to contain stderr, got %q", err.Error())
+	}
+}