Craft dry-run wrappers

Use Craft's centralized dry-run proxies for destructive work: getGitClient()/createGitClient() for Git, getGitHubClient() for GitHub, safeFs for writes/deletes, and safeExec/safeExecSync for other commands. Do not add per-function isDryRun() guards by default: that duplicates policy and can miss side effects. Use explicit checks only for tools with native dry-run flags, mock data, or UX optimizations such as skipping sleeps.