The heredoc parsed a hardcoded sample command that reads no repository
state and drifted from the real wrapper long ago (the generated command
uses --app-name=CodexBar --icon=view-statistics; the sample did not). It
always exited 0, so it guarded nothing while implying coverage.

The actual /bin/sh-validity guard is the require_in_surface pin on the
":; " prefix of connectNotificationCommand(commandWithRunNonce(...)):
a shell assignment cannot prefix the reserved word "if", so any edit
that breaks the wrapper fails that assertion. Document that role in a
comment so a vacuous syntax check does not grow back.