toolshed: silence S607 on clean.py's git invocations

The bandit workflow (ruff --select S) and pre-commit.ci both failed on
toolshed/clean.py: S607, starting a process with a partial executable
path. Annotate the two `git` argv lists the way the rest of the repo
already does -- see toolshed/check_spdx.py and
toolshed/check_precommit_installed.py, which carry the same noqa for the
same reason.

Verified with the exact command the workflow runs:
`ruff check --select S --ignore S101,S311,S404 .` -> all checks passed,
and `pre-commit run --all-files` is clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: rparolin

toolshed/clean.py

@@ -72,7 +72,7 @@
 def repo_root() -> Path:
     """Return the top level of the worktree containing this script."""
     out = subprocess.run(
-        ["git", "rev-parse", "--show-toplevel"],
+        ["git", "rev-parse", "--show-toplevel"],  # noqa: S607
         cwd=Path(__file__).resolve().parent,
         capture_output=True,
         check=True,
@@ -101,7 +101,7 @@ def ignored_paths(root: Path) -> list[str]:
     the outermost path of each artifact tree.
     """
     out = subprocess.run(
-        ["git", "status", "--porcelain", "-z", "--ignored"],
+        ["git", "status", "--porcelain", "-z", "--ignored"],  # noqa: S607
         cwd=root,
         capture_output=True,
         check=True,