Fix facts registry commands and make precheck parsing escape-aware

Why: F2 token extraction predates the two-section (HOME/IMC) layout of
~/.secrets/gitea so it concatenated both tokens and always failed; F6
registered a grep BRE alternation that facts-verify unescapes into a
literal pipe, failing re-verification and misaligning precheck's naive
pipe split into a spurious F6 date-format expiry warning, while both
underlying facts still hold.

Evidence: make facts-verify now 6/6 PASS with last_verified refreshed
to 2026-10-14; new regression test for escaped pipes in facts rows;
full governance suite 342 tests OK (18 skipped); precheck [facts] line
reports all facts fresh on the fixed parser.

Impact: policy/facts.md F2 (HOME-section awk extraction) and F6
(negated pipe-free grep); scripts/task.sh precheck neutralizes escaped
pipes the same way facts-verify does; tests/test_task.py covers it.

Refs: precheck WARN 过期事实 F6(日期格式); AGENTS.md 证据与验证门禁.

scripts/task.sh

@@ -91,7 +91,10 @@ cmd_precheck() {
   # [facts] 外部事实登记表过期项（policy/facts.md；引用前先跑其验证命令，AGENTS.md 证据与验证门禁）。
   if [ -f policy/facts.md ]; then
     local fid lv ttl expired="" ftotal=0
-    while IFS='|' read -r _ fid _ _ lv ttl _; do
+    while read -r factline; do
+      # 单元格内转义竖线（\|）先中和，与 facts-verify 的还原约定一致，避免命令列把日期列顶偏
+      factline=${factline//\\|/$'\x01'}
+      IFS='|' read -r _ fid _ _ lv ttl _ <<<"$factline"
       fid=$(echo "${fid:-}" | tr -d ' '); case "$fid" in F[0-9]*) ;; *) continue ;; esac
       ftotal=$((ftotal+1))
       lv=$(echo "$lv" | tr -d ' '); ttl=$(echo "$ttl" | tr -d ' ')