refactor: share repeated helpers in the root module

[bobzhang]

This half needs a careful read. Every hunk here adds or removes something
SHARED, so correctness depends on code outside the hunk you are looking at. The
purely in-function rewrites this was mixed with have moved to a separate pull
request, so what is left is all shared-surface change.

What to check, hardest first:

1. An extracted helper must be equivalent at every call site it replaced.
   The trap is a call site that passed a different argument, or read state at a
   different moment, than its neighbours.
2. A merged or-pattern arm must have had identical bodies. Where the arms
   differed and the difference moved inside the arm, the fold buys less than it
   appears to.
3. A reshaped loop must keep its iteration order and its early exits.

Scope: the root module. The shared pieces are any_arg_before_ddash for the git-policy option scans, realpath_or_same and first_protected_workspace_source in the shell sandbox, the viz app's filter and card helpers, and array_field across the eval harness.

Review comments addressed

• "why such change in a refactoring?" on mbtx_fixture — reverted. The
  fixture no longer registers a group defer for the spill directory, and all
  twelve tests reclaim it at the end of their own body as before. That hunk
  moved cleanup from end-of-test to end-of-group, which runs it later and also
  on assertion-failure paths where the old tail was never reached. It may be an
  improvement, but it is a behaviour change and does not belong in a refactor.
  wait_until and the table-driven registry test, which change nothing
  observable, stay.
• for arg in words[start:end]? — applied. any_arg_before_ddash iterates
  the slice directly instead of indexing.

Verified on this branch alone

moon fmt --check, moon check --target native --deny-warn, moon check --target js --deny-warn, and both full test suites, with no other part of the
refactor applied. No .mbti changed.

---

The refactor is split so each pull request asks one kind of question. Every file
appears in exactly one of them, each was verified on its own branch with no
other part applied, so they merge in any order.

	easy to review	needs a careful read
root	#1330	this one (#1325)
desktop/	#1331	#1326
editor/	#1332	#1327
tests	#1333	#1328

🤖 Generated with Claude Code

https://claude.ai/code/session_01JiBNGzCsZpN6e5Y4p9pXdn

[bobzhang]

why such change in a refactoring?

[bobzhang]

Fair, and reverted. mbtx_fixture no longer registers a group defer for the
spill directory, and all twelve tests reclaim it at the end of their own body
again, exactly as before.

You are right that it does not belong in a refactor: moving cleanup from
end-of-test to end-of-group runs it later, and also runs it on
assertion-failure paths where the old trailing rmdir was never reached. My
own review of this sweep had flagged it as the single hunk that was not
behaviour-preserving, so your question is the right verdict on it. If the
better lifetime is wanted, it should be its own change with that as the stated
point.

The wait_until poller and the table-driven registry test stay: neither
changes anything observable.

[bobzhang]

for arg in words[start:end]?

[bobzhang]

Applied. any_arg_before_ddash iterates words[start:end] directly, so the
index binding is gone.